3 ms·
If it had been simply an overzealous intern, wouldn't they have just announced that like a normal security bug?
by marshray 11y ago
If it had been simply an overzealous intern, wouldn't they have just announced that like a normal security bug?
- bch 11y agoI guess the question is: "why qualify the bug at all?" and work backwards. If it's a bad actor that did this, did they qualify it because the effects are so heinous they don't want to take responsibility for the code (but admit to being hacked)? If it were an intern, they are still disavowing the code, but admitting something slipped through audit cracks. What's worse, or what's the motivation (and cost) for qualifying the flaw? I don't know the answer, just putting out a question. [Edit: lots of swype typos]