4 ms·

I think "irresponsible disclosure" would involve disclosing it to black hats for money.

• djrogers 9y ago
  Well, it has been disclosed to black hats - just not for money. To end users the result is the same; black hats have an unpatched 0day to play with, and we have no mitigations to deploy.
  • zbentley 9y ago
    Well, we do have mitigations. They're not good ones, but they're mitigations: - Be more paranoid about allowing r/w direct access to your computer. - Be prepared to power off or otherwise halt your machine if (on 10.13.12) you see unexpected logouts or similar. - Safeguard your data and/or consider moving it off of the machine or not using it in some situations. None of those are great things to rely on or to have to do. A real working patch or detection mechanism would definitely be better. But that's not the same as "no mitigations" whatsoever.
  • danieldk 9y ago
    The end result is not the same. You know about the bug as well, whereas if the bug + exploit was sold to black hats, they can use it without your awareness. This would be a less serious problem if vendors pushed out fixes faster.
    • floatingatoll 9y ago
      Note that 99.99% or more of end users remain unaware of this bug, regardless of this HN post about it.