4 ms·

I get it, I really do, but it's not like he was complaining about a bad Uber driver. Disclosure in this way has real-world impacts up to and including harming

I get it, I really do, but it's not like he was complaining about a bad Uber driver. Disclosure in this way has real-world impacts up to and including harming people and we shouldn't ever consider it as something which is remotely acceptable. Is it acceptable to publicly disclose that an airport has a self-destruct switch which can be accessed near the NW mens bathroom? No. You contact someone who can fix the problem, then publicly disclose.

sillysaurus3 9y ago
It's as remotely acceptable as "root" with no password, apparently. The question is large and complicated, and people can agree to disagree. There's nothing wrong with tweeting vulns: The company is at fault, we can defend ourselves now that we know about the vuln, and it's a big PR disaster for Apple. A past conversation: https://news.ycombinator.com/item?id=14009937 https://news.ycombinator.com/item?id=14009937 No, no it's not strictly more ethical. It's not even strictly safer, which should be an even easier question to answer. The baked-in assumption in your logic is that users have no options other than waiting to patch. But, obviously, they do, and keeping vulnerabilities secret deprives them of those options.
- openasocket 9y ago
  > The question is large and complicated, and people can agree to disagree > There's nothing wrong with tweeting vulns Those two statements seem to be contradictory. It seems to me there is still quite a lot of debate about which disclosure policy is best,
testvox 9y ago
But everyone can fix this problem by setting a root password. So telling everyone is the right call. Otherwise people would be sitting vulnerable while Apple comes up with a patch.
- openasocket 9y ago
  But a tweet isn't really the most effective way to tell everyone. Technical people, including those who would use this vulnerability for malice, will find out far far sooner than my grandmother. It seems to me the right thing to do is to tell Apple privately, tell them to either push a fix or put out some kind of release letting all their customers know how to mitigate this in the next, say, 3 days, or I'll just tweet about it. What's the downside? At the worst case, you just prolonged the status quo for another 3 days.
  - thomastjeffery 9y ago
    It's not the most effective, but that doesn't make it bad, or malicious.
    - openasocket 9y ago
      I agree this person isn't malicious, certainly. But I do think his decision was bad. Not "bad" in the moral sense, but "bad" in the sense of being sub-optimal.
      - sooheon 9y ago
        Was his tweeting strategy more or less "sub-optimal" than Apple's security QA? I think we're focusing on the wrong part of this story.

sillysaurus3 9y ago

It's as remotely acceptable as "root" with no password, apparently. The question is large and complicated, and people can agree to disagree. There's nothing wrong with tweeting vulns: The company is at fault, we can defend ourselves now that we know about the vuln, and it's a big PR disaster for Apple. A past conversation: https://news.ycombinator.com/item?id=14009937 https://news.ycombinator.com/item?id=14009937 No, no it's not strictly more ethical. It's not even strictly safer, which should be an even easier question to answer. The baked-in assumption in your logic is that users have no options other than waiting to patch. But, obviously, they do, and keeping vulnerabilities secret deprives them of those options.

openasocket 9y ago
> The question is large and complicated, and people can agree to disagree > There's nothing wrong with tweeting vulns Those two statements seem to be contradictory. It seems to me there is still quite a lot of debate about which disclosure policy is best,

testvox 9y ago

But everyone can fix this problem by setting a root password. So telling everyone is the right call. Otherwise people would be sitting vulnerable while Apple comes up with a patch.

openasocket 9y ago
But a tweet isn't really the most effective way to tell everyone. Technical people, including those who would use this vulnerability for malice, will find out far far sooner than my grandmother. It seems to me the right thing to do is to tell Apple privately, tell them to either push a fix or put out some kind of release letting all their customers know how to mitigate this in the next, say, 3 days, or I'll just tweet about it. What's the downside? At the worst case, you just prolonged the status quo for another 3 days.
- thomastjeffery 9y ago
  It's not the most effective, but that doesn't make it bad, or malicious.
  - openasocket 9y ago
    I agree this person isn't malicious, certainly. But I do think his decision was bad. Not "bad" in the moral sense, but "bad" in the sense of being sub-optimal.
    - sooheon 9y ago
      Was his tweeting strategy more or less "sub-optimal" than Apple's security QA? I think we're focusing on the wrong part of this story.