4 ms·
> Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool no one is under any obligation to sweep company's security problems under t
by saas_co_de 9y ago
> Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool
no one is under any obligation to sweep company's security problems under the rug for them.
If companies create incentives for people to share vulnerabilities with them first, great, but no one is under any obligation to participate in those programs.
Don't ship broken software if you don't want pie in your face.
- azernik 9y agoForget the company. This harms users, who are not responsible for causing these issues; for all except the most technical 1% of Apple users, keeping the problem secret while Apple works on a quick patch is much more secure than telling the whole world immediately.
- flukus 9y agoIf it harms the company then they will take it more seriously and it will protect users more in future. If it doesn't harm the company then they have no incentive to change.
- rched 9y agoThis isn’t about what’s best for Apple it’s about what is best for users. The way this was disclosed was bad for users.
- saas_co_de 9y agoIn almost all cases immediate disclosure is better for end users who actually care about their security because they can take appropriate mitigation measures. Just because the vulnerability is not disclosed does not mean it is not being actively exploited. It probably is. Users who don't care about their security do not deserve to be "protected" at the expense of compromising the security of those who do care who benefit from immediate disclosure.