4 ms·
> If you as a security researcher reasonably believe the vendor has neglected to patch the vulnerability, and you release exploit details, you are amplifying th
by sgift 9y ago
> If you as a security researcher reasonably believe the vendor has neglected to patch the vulnerability, and you release exploit details, you are amplifying the current harm it's inflicting.
At least the public now has a fair chance to evaluate if they want to use their devices despite this vulnerabilities.
- etjossem 9y agoThat's true, but it glibly ignores the reality of vendor lock-in. The average non-infosec human is not going to switch devices because of a vulnerability whitepaper. This "vuln-insensitive user" is better served by giving the vendor a longer timeline to take care of the issue, rather than releasing exploit details two weeks after someone changed a status on a ticket.
- AstralStorm 9y agoThen fight the lock-in, in court if necessary. Tort lawyer will have some fun with it if you can show you cannot evade losses of secure data. I am pretty sure the line of defence will be weak "no warranty" claim that has nothing to do with lock in.
- chipperyman573 9y agoI feel that this rebuttle is silly. Nobody outside HN (and similar) will understand what this means. And, even if they do, many users cannot afford to buy an iPhone (the only real competition) just because of one security flaw that might affect them. Even then, the opportunity cost of switching is not minimal.
- ocdtrekkie 9y agoThe fact that the only competition is unaffordable to a product with 85% global market share is a strong indicator we need to bust a monopoly for the public interest.
- amygdyl 9y agoI wonder if Apple was perceived to be playing a security first product approach, whether this same audience would not be able to find a far more forgiving view of the Apple price list?