3 ms·
One point I take away is that there's something even better than "responsible disclosure": talk to your local CERT instead of the company affected, unless you t
by red_admiral 10y ago
One point I take away is that there's something even better than "responsible disclosure": talk to your local CERT instead of the company affected, unless you trust the company will handle it professionally.
- josephb 10y agoIt seems plausible that big organisations might take the contact from an individual as "I haz ur data, omg Haxor!", then call the police. Whereas the approach from a local CERT agency is likely to be taken more seriously, acted on more speedily, and possibly result in less blowback on the individual who came across the information and reported it.
- tajen 10y agoOne point I take away is, the more data there is, the more costly it is to secure it with procedures. Hence, we should require an insurance every time we collect and merge data, and start hugely increase the fines, just to make sure insurances will be requiring the right procedures. Or, you know, just don't keep the data.