3 ms·

I strongly disagree. right now you are just taking about vulnerabilities in general but there's varying levels of impact. are these vulnerabiluties ok to tweet?

I strongly disagree. right now you are just taking about vulnerabilities in general but there's varying levels of impact. are these vulnerabiluties ok to tweet? - able to see someone else's recipes on a cooking app without permission - some has ability to transfer money away from your account - disable a pacemaker remotely https://venturebeat.com/2008/08/08/defcon-excuse-me-while-i-turn-off-your-pacemaker/ https://venturebeat.com/2008/08/08/defcon-excuse-me-while-i-... because how closely technology is to our lives there will always be sensitive things behind someone's code or design as the only defense. it's not always information at risk. there are unethical bugs to publicly expose

godelski 10y ago
I only mostly agree with this. I think there is an ethics in how you release. I 100% believe you should disclose the bug to the responsible party. Give a reasonable time for them to fix, check, and then disclose to the public. If you check and they are working on it then give them more time (offer to help? Doesn't have to be free). If they push you off then post it everywhere and well... we know how that goes. If they do fix it then add it to your resume and everyone is happy. In my opinion, all vulnerabilities should be disclosed to the public. This helps prevent the same mistake from being done twice (or in reality, thousands of times). BUT there is a reasonable way to disclose. Some things are more vulnerable than others (like a cache of everyone's passwords or a device that controls someone's heart...). Public discloser makes more people aware of this. We say security through obscurity isn't security, but that is only true to an extent. tldr: Always disclose, but do it responsibly.