4 ms·
I'd say, at that point, it becomes a security issue. They'd probably agree. Just because it isn't categorized as a security issue doesn't mean their engineers
by 013a 9y ago
I'd say, at that point, it becomes a security issue. They'd probably agree.
Just because it isn't categorized as a security issue doesn't mean their engineers aren't looking for solutions, even if they're publicly trying to downplay the issue. And just because its not a security issue today doesn't mean it can't be escalated into one when we know more about the exploit.
They're not dumb. In fact, I'd say they're acting with more logic and measure than the alarmists in this thread.
- kbenson 9y agoThey may well be treating it intelligently inside the org (which is to say they may not be discounting and ignoring it entirely), which is a good thing. My response was more aimed towards the people here that took a less nuanced view, and assumed it wasn't exploitable or a security problem just because that's how an engineer initially categorized it. Every bug that causes the system to malfunction should be considered a possible security problem. The difference is how much severity you rate it and how quickly you decide to address it. It's the "So the bug cannot really be exploited to compromise security..." point of view I find dangerous. Historically it's led to quite a few problems.