4 ms·
I don't know their organization/development structure, but couldn't it also mean (for example) an overzealous intern committed where not authorized, and it pass
by bch 11y ago
I don't know their organization/development structure, but couldn't it also mean (for example) an overzealous intern committed where not authorized, and it passed into a production release? It's early to tell, and hard to tease from Junipers message. On the one hand, one might say they'd like to see more info from Juniper, but on the other, courageous of Juniper to be as forthcoming as they are.
- marshray 11y agoIf it had been simply an overzealous intern, wouldn't they have just announced that like a normal security bug?
- bch 11y agoI guess the question is: "why qualify the bug at all?" and work backwards. If it's a bad actor that did this, did they qualify it because the effects are so heinous they don't want to take responsibility for the code (but admit to being hacked)? If it were an intern, they are still disavowing the code, but admitting something slipped through audit cracks. What's worse, or what's the motivation (and cost) for qualifying the flaw? I don't know the answer, just putting out a question. [Edit: lots of swype typos]