3 ms·
Is social media the goto for reporting security vulnerabilities in 2017? If I remember correctly, one is supposed to make it public once patched or in event of
by myth_buster 9y ago
Is social media the goto for reporting security vulnerabilities in 2017?
If I remember correctly, one is supposed to make it public once patched or in event of no response, no?
Edit:
What is "Responsible Disclosure"[0]?
[0] https://en.wikipedia.org/wiki/Responsible_disclosure https://en.wikipedia.org/wiki/Responsible_disclosure
- ams6110 9y agoSomeone notices that they can log in as root with no password. In 2017, reflexively tweeting about it seems pretty unsurprising.
- fredsted 9y agoSeems like the guy just discovered this by accident. It's not like you'd have to be a security engineer to stumble upon this.
- donatj 9y agoI think the difference is if the problem is discovered by Joe Schmoe or a security researcher.
- cotillion 9y agoThis is one of those cases where responsible disclosure just means you're doing the job one of apples automated tests should be doing.
- FireBeyond 9y agoWhere is Joe Random's obligation to responsibly disclose? To whom does he owe that obligation? Apple? The public? Both? Why?
- TallGuyShort 9y agoIn my opinion they don't "owe" anyone that obligation, unless it's a contractual obligation associated with using a Mac. But just because it's not owed to anyone, doesn't mean there isn't a nicer way to handle it just to be nice. That said, I don't immediately see evidence that this gentleman is in the security field, and perhaps isn't aware of responsible disclosure. Full disclosure isn't the worst thing in the world.
- testvox 9y agoFull disclosure is also a form of responsible disclosure.
- DonHopkins 9y agoTwitter's also the goto for banning trans people from military service, attacking freedom of the press, threatening to declare nuclear war, and all kinds of other things too.