5 ms·

Maybe he didn't know about the proper procedures to handle a security vulnerability. You wouldn't have to be a security researcher to discover this bug, and I d

Maybe he didn't know about the proper procedures to handle a security vulnerability. You wouldn't have to be a security researcher to discover this bug, and I don't see any indication that he is one.

overcast 9y ago
I would say it's pretty basic common sense, not to publicly announce ANYTHING that could immediately affect millions of people. Unless he's just a sociopath. From his Twitter account, he's not just some layman stumbling across it. Agile Software Craftsman, iyzicoder @ http://www.iyzico.com http://www.iyzico.com , Founder of Software Craftsmanship Turkey @scturkey, The community guy http://bit.ly/lemiorhan http://bit.ly/lemiorhan
- mikeash 9y ago
  If that were true, then the security community wouldn't have spent years fighting about whether responsible disclosure was the right approach. That's for people who actually understand this stuff. It's unreasonable to expect an outsider to derive it all on their own from first principles.
  - overcast 9y ago
    So someone stumbles upon a lost cache of chemical weapons. Rather than reporting to the authorities, they post its location on Twitter. That's called just using your brain.
    - mikeash 9y ago
      You're coming at this from a position of knowledge and assuming everyone else knows as much as you do, or should be able to figure it out in short order. That's not how it works. It's really hard to see how other people might think in situations like this.
      - overcast 9y ago
        The guy is a self professed "Agile Software Craftsman". I could give some leeway to my average friend finding this, but he's pretty involved with this community.
        mikeash 9y ago
        It seems like every programmer on HN is also deeply interested in security, but I don't think that's generally true elsewhere.
    - testvox 9y ago
      Security though obscurity is no security at all. Don't you think the people living around the chemical weapons should be informed too so they can take precautions to protect themselves?
Jedd 9y ago
Maybe. Look at his twitter page though: https://twitter.com/lemiorhan https://twitter.com/lemiorhan Not impossible to believe he's unaware of the right way of handling this kind of issue, but that banner photo (Enthralling My F-ing Audience) [1] and stats there suggest he should be aware that there probably are sensible and polite procedures for this, even if he didn't immediately know what they were. [1] http://jesuschristsiliconvalley-blog.tumblr.com/post/46537875392/what-your-profile-picture-says-about-you-hint http://jesuschristsiliconvalley-blog.tumblr.com/post/4653787...
- mikeash 9y ago
  How do the banner or stats suggest he should have known about this?
  - Jedd 9y ago
    He is giving a technical talk to a large audience. Slides refer to development, and bio implies this means software development. Bio uses the phrase 'founder of software craftsmanship Turkey'. Following the link to his home page we find: "He has worked as software architect, software craftsman, technical leader, team leader, technical coordinator, Scrum Master and Agile coach in dozens of software projects at BYM, GittiGidiyor / eBay and Sony." and "Lemi Orhan Ergin is a Software craftsman, passionate developer, technical architect, Agile culture cultivator, Agile coach, Scrum / Kanban practitioner and trainer, Management 3.0 trainer, experienced mentor, engineering booster, Git trainer and lover, the TDD guy, clean coder, infected with the technical side of Agile, presentation and visualization freak, non-stop learner, full time apprentice of my masters, the community guy." It's possible this guy was oblivious to the idea that there's a good way to share this information with Apple / The World At Large, and consequently did not attempt to find out the preferred way of doing it, but I don't buy it.
    - mikeash 9y ago
      Are you proposing that being an active programmer implies familiarity with responsible disclosure? That doesn't follow in my mind.
always_good 9y ago
Also, it's reasonable for someone to think that making a public stink about it is in the best interest of all the people then that can immediately patch it themselves instead of having to wait for Apple to push a patch and then for everyone to download that patch. I'm not convinced private disclosure is without its downsides nor a panacea.

Maybe he didn't know about the proper procedures to handle a security vulnerability. You wouldn't have to be a security researcher to discover this bug, and I don't see any indication that he is one.

overcast 9y ago

I would say it's pretty basic common sense, not to publicly announce ANYTHING that could immediately affect millions of people. Unless he's just a sociopath. From his Twitter account, he's not just some layman stumbling across it. Agile Software Craftsman, iyzicoder @ http://www.iyzico.com http://www.iyzico.com , Founder of Software Craftsmanship Turkey @scturkey, The community guy http://bit.ly/lemiorhan http://bit.ly/lemiorhan

mikeash 9y ago
If that were true, then the security community wouldn't have spent years fighting about whether responsible disclosure was the right approach. That's for people who actually understand this stuff. It's unreasonable to expect an outsider to derive it all on their own from first principles.
- overcast 9y ago
  So someone stumbles upon a lost cache of chemical weapons. Rather than reporting to the authorities, they post its location on Twitter. That's called just using your brain.
  - mikeash 9y ago
    You're coming at this from a position of knowledge and assuming everyone else knows as much as you do, or should be able to figure it out in short order. That's not how it works. It's really hard to see how other people might think in situations like this.
    - overcast 9y ago
      The guy is a self professed "Agile Software Craftsman". I could give some leeway to my average friend finding this, but he's pretty involved with this community.
      - mikeash 9y ago
        It seems like every programmer on HN is also deeply interested in security, but I don't think that's generally true elsewhere.
  - testvox 9y ago
    Security though obscurity is no security at all. Don't you think the people living around the chemical weapons should be informed too so they can take precautions to protect themselves?

Jedd 9y ago

Maybe. Look at his twitter page though: https://twitter.com/lemiorhan https://twitter.com/lemiorhan Not impossible to believe he's unaware of the right way of handling this kind of issue, but that banner photo (Enthralling My F-ing Audience) [1] and stats there suggest he should be aware that there probably are sensible and polite procedures for this, even if he didn't immediately know what they were. [1] http://jesuschristsiliconvalley-blog.tumblr.com/post/46537875392/what-your-profile-picture-says-about-you-hint http://jesuschristsiliconvalley-blog.tumblr.com/post/4653787...

mikeash 9y ago
How do the banner or stats suggest he should have known about this?
- Jedd 9y ago
  He is giving a technical talk to a large audience. Slides refer to development, and bio implies this means software development. Bio uses the phrase 'founder of software craftsmanship Turkey'. Following the link to his home page we find: "He has worked as software architect, software craftsman, technical leader, team leader, technical coordinator, Scrum Master and Agile coach in dozens of software projects at BYM, GittiGidiyor / eBay and Sony." and "Lemi Orhan Ergin is a Software craftsman, passionate developer, technical architect, Agile culture cultivator, Agile coach, Scrum / Kanban practitioner and trainer, Management 3.0 trainer, experienced mentor, engineering booster, Git trainer and lover, the TDD guy, clean coder, infected with the technical side of Agile, presentation and visualization freak, non-stop learner, full time apprentice of my masters, the community guy." It's possible this guy was oblivious to the idea that there's a good way to share this information with Apple / The World At Large, and consequently did not attempt to find out the preferred way of doing it, but I don't buy it.
  - mikeash 9y ago
    Are you proposing that being an active programmer implies familiarity with responsible disclosure? That doesn't follow in my mind.

always_good 9y ago

Also, it's reasonable for someone to think that making a public stink about it is in the best interest of all the people then that can immediately patch it themselves instead of having to wait for Apple to push a patch and then for everyone to download that patch. I'm not convinced private disclosure is without its downsides nor a panacea.