5 ms·
I'm glad places like IOActive exist. Reading up on their procedure (http://www.ioactive.com/pdfs/IOActive_Advisory_SimpliSafe-Replay.pdf http://www.ioactive.com
by rubidium 11y ago
I'm glad places like IOActive exist. Reading up on their procedure (http://www.ioactive.com/pdfs/IOActive_Advisory_SimpliSafe-Replay.pdf http://www.ioactive.com/pdfs/IOActive_Advisory_SimpliSafe-Re...), they gave the vendor 5 months to even respond before posting this. All and all a much better process than a "hacker" posting it to his blog because a company didn't respond to his email the day before.
There's no such thing as perfect security via alarm. However, if a company refuses to even respond to someone reporting a vulnerability, then the public should be informed.
As a simplisafe customer, I will be contacting them and demanding a fix to this vulnerability or full refund.
- gruez 11y ago>All and all a much better process than a "hacker" posting it to his blog because a company didn't respond to his email the day before. I actually never seen this happen.
- joshstrange 11y agoSame here, in fact I'm often blown away but the timelines at the bottoms of reports like this. Not in a "they should have released this sooner" type of way but more of a "wow, they were extremely patient with this vendor after numerous delays and all out of the goodness of their hearts". It would be just as easy for these researchers to say say "hmm interesting" and never alert the vendor or publish the findings.
- uremog 11y agoThat and it's a very nice report to read. Very understandable.