4 ms·

That's true, but it doesn't matter. It's still broken. That's why we have automatic release after a set time. Because it's a problem for the public even if the

That's true, but it doesn't matter. It's still broken. That's why we have automatic release after a set time. Because it's a problem for the public even if the vendor has zero resources. The ability of the vendor to fix the problem is not related at all to the potential damage the problem can cause. Worst-case scenario? The software is shutdown and/or withdrawn from the market because the vendor can't fix it. Not that the vulnerability isn't announced. What we need is a public and open way to do this that doesn't involved walled gardens.

adrianN 10y ago
I don't want anyone to be able to shutdown and/or withdraw software that I'm using for any reason. That cure is worse than the disease.
- DanielBMarkham 10y ago
  Personally I don't want you to have to. As far as I'm concerned, if you're notified in big, red letters (perhaps every time the software starts)? Works for me. As long as you know -- and are reminded. (That's because different people use the same software. If the notice only appeared once, a new person might start using the software/machine and not be aware of what's going on) But if you had a piece of software with a terrible vulnerability that was currently being exploited to do some sort of terrible harm? Beats me. Does my right to use the internet without being DDOSed override your right to use unsafe software if you want?
  - stupidhn 10y ago
    Not sure why you're down voted. I had the same thought as parent, but this seems like the answer. A standard splash screen on load that pops up for 10 seconds and says "this program has known active vulnerabilities that are unpatched". If people choose to ignore it, that's on them. Cheap and easy, no?
    - adrianN 10y ago
      That still requires that a third party is allowed to flash things on my screen without my explicit consent.
      - DanielBMarkham 10y ago
        Does it? We already have a solution to this, which I hate: walled gardens. I'm exploring options that preserve the peace while not letting companies effectively own their users. Maybe there is no answer that makes everybody happy. That's why it's worth asking questions. Just so I understand this, you're saying that if you have a piece of hardware that's say, taking down the local ISP because you're running compromised software on it, you don't want to even be notified before your box is compromised or that there might be a problem. Well, dang. Something's going to happen. That much is sure. What's the first notification you'd like that you're destroying the internet experience for others and perhaps ruining a local business? SWAT team at the door? I hear your complaint. I'm just not able to figure out how it makes sense.
        adrianN 10y ago
        I don't want other people to be able to change things on my computer. If my setup is causing problems on their end, they have my contact information and can tell me over traditional routes. An ISP can cut off my internet connection if they detect suspicious traffic.
Terr_ 10y ago
There's also an aspect of "capitalist tough-love". Sometimes companies do have resources for fixes and for general security-quality, but they don't budget or prioritize because there's no strong economic incentive.
deleted 10y ago
[deleted]

adrianN 10y ago

I don't want anyone to be able to shutdown and/or withdraw software that I'm using for any reason. That cure is worse than the disease.

DanielBMarkham 10y ago
Personally I don't want you to have to. As far as I'm concerned, if you're notified in big, red letters (perhaps every time the software starts)? Works for me. As long as you know -- and are reminded. (That's because different people use the same software. If the notice only appeared once, a new person might start using the software/machine and not be aware of what's going on) But if you had a piece of software with a terrible vulnerability that was currently being exploited to do some sort of terrible harm? Beats me. Does my right to use the internet without being DDOSed override your right to use unsafe software if you want?
- stupidhn 10y ago
  Not sure why you're down voted. I had the same thought as parent, but this seems like the answer. A standard splash screen on load that pops up for 10 seconds and says "this program has known active vulnerabilities that are unpatched". If people choose to ignore it, that's on them. Cheap and easy, no?
  - adrianN 10y ago
    That still requires that a third party is allowed to flash things on my screen without my explicit consent.
    - DanielBMarkham 10y ago
      Does it? We already have a solution to this, which I hate: walled gardens. I'm exploring options that preserve the peace while not letting companies effectively own their users. Maybe there is no answer that makes everybody happy. That's why it's worth asking questions. Just so I understand this, you're saying that if you have a piece of hardware that's say, taking down the local ISP because you're running compromised software on it, you don't want to even be notified before your box is compromised or that there might be a problem. Well, dang. Something's going to happen. That much is sure. What's the first notification you'd like that you're destroying the internet experience for others and perhaps ruining a local business? SWAT team at the door? I hear your complaint. I'm just not able to figure out how it makes sense.
      - adrianN 10y ago
        I don't want other people to be able to change things on my computer. If my setup is causing problems on their end, they have my contact information and can tell me over traditional routes. An ISP can cut off my internet connection if they detect suspicious traffic.

Terr_ 10y ago

There's also an aspect of "capitalist tough-love". Sometimes companies do have resources for fixes and for general security-quality, but they don't budget or prioritize because there's no strong economic incentive.

deleted 10y ago

[deleted]