4 ms·
> How do you determine if a vulnerability was there because it was overlooked in development, or if it was there because the government demanded it from the com
by exelius 11y ago
> How do you determine if a vulnerability was there because it was overlooked in development, or if it was there because the government demanded it from the company but used the law to impose a gag order on the company preventing the public from finding out about it?
You don't; but that's possible today with the way the gag orders and FISA courts work. That's a real problem around transparency in our legal system; which IMO is a different issue from transparency around security issues relating to privately-developed products.
- coherentpony 11y agoThat's a really interesting viewpoint. Thanks for sharing it. In my opinion the government should be obliged to share the vulnerability for the purposes of the keeping the rest of the users safe from the same exploit, whether executed by the government or executed by somebody else. In summary, I disagree with you but I'm glad I took the time to ask you about your view since I learned something new.