5 ms·

Are there possible legal consequences to acknowledging such a report, though? Maybe it's not just psychological, but a CYA move.

• scaryclam 8y ago
  It's unlikely. Many companies handle this sort of thing every day and don't deny the issue, just delay confirmation. It's more likely that someone within Docker decided that they didn't believe the report, but didn't bother to investigate properly before responding.
• Kalium 8y ago
  Generally no, there is minimal liability attached to acknowledging a report. There may be internal political issues and definitely external media ones, though. Nobody wants to be the person who says "We're vulnerable, but I don't care enough to fix it". That's how you get internal political battles. Denial solves that problem. When dealing with external reports, it means ammunition for dealing with third parties. "We are not aware of any such vulnerabilities" becomes a defensible position, as does telling reporters that you dispute the claims of vulnerability. Those buy time to maybe fix something. And, well, there's the CYA psychology too. Nobody wants to confront the idea that they, or their smart and hard-working coworkers, screwed up to the point of creating a significant vulnerability.