4 ms·
But if he found them, then someone else could have _already_ found them and downloaded the data. The problem isn't that Uber paid him for finding the vulnerabi
by deedubaya 9y ago
But if he found them, then someone else could have _already_ found them and downloaded the data.
The problem isn't that Uber paid him for finding the vulnerability, but that Uber kept it secret for so long.
- tptacek 9y agoThat doesn't make sense. Serverside RCEs get disclosed all the time. If you take the median large SFBA tech company and stipulate serverside RCE, you're almost 100% of the time going to be an hour or two away from breach-disclosure-law event. But that never happens. What was different in this case?