2 ms·

Something similar happened to me with Amazon a while back. Found some vulns, and they fixed them but never publicly acknowledged them - because they said "the c

by kerng 8y ago

Something similar happened to me with Amazon a while back. Found some vulns, and they fixed them but never publicly acknowledged them - because they said "the cloud is always patched", so no need to tell anyone- which I thought was an odd response.

rocketChat 8y ago
Same for the RocketChat developers: https://github.com/RocketChat/Rocket.Chat/pull/10793 https://github.com/RocketChat/Rocket.Chat/pull/10793 "We do not disclose security fixes as soon we have them fixed to prevent bad guys to exploit them." "as soon we have" means never. They believe bad guys would not monitor the commits of target products.
- lysp 8y ago
  Not disclosing in release change logs potentially increase the chance of people being affected. If I see a changelog with XSS fixed I will update a product straight away, if I don't - I might leave it a week or two until I have time.