4 ms·
I guess this is worth taking into account when discussing "responsible" disclosure. It's such a glaring vulnerability that other people already knew about and s
by runesoerensen 9y ago
I guess this is worth taking into account when discussing "responsible" disclosure. It's such a glaring vulnerability that other people already knew about and shared publicly (although seemingly no-one in that forum thread considered it a security issue).
A lot seem to think there's only one way to responsibly disclose vulnerabilities (e.g. https://news.ycombinator.com/item?id=15800676 https://news.ycombinator.com/item?id=15800676), but that's really not the case at all if end-user security is the priority. It's very likely that quite a few already used this maliciously as well, and the more responsible thing to do in that case probably was to announce it (along with a temporary mitigation) to as many people as possible.
Btw credit to https://twitter.com/fristle/status/935670476214378496 https://twitter.com/fristle/status/935670476214378496 for finding this!
- beedogs 9y agoUhh.... are you sure you're commenting on the right story?
- AnkhMorporkian 9y agoPretty sure they are. What other post could they be commenting on?
- strictnein 9y agoThe other one where somebody posted this on Twitter. This one: https://news.ycombinator.com/item?id=15800676 https://news.ycombinator.com/item?id=15800676
- runesoerensen 9y agoNo I linked to that story in my comment :) I suspect grandparent missed the context because the title of this story was changed from "Apple security vulnerability posted on developer forums as troubleshooting tip" to "Updated to High Sierra, all Admin accounts now Standard". I've updated my comment to include a link to the source for context.
- AnkhMorporkian 9y agoYou're 100% correct, that's why I didn't get the context. The title had already changed.
- jph 9y agoCoordinated Disclosure notes are here:https://github.com/joelparkerhenderson/coordinated_disclosure https://github.com/joelparkerhenderson/coordinated_disclosur... (Note: Coordinated Disclosure is the newer term for what had been called Responsible Disclosure)