3 ms·
I'm mildly surprised no-one has so far drawn the similarity to full-disclosure. Because let's be fair, this practice is full-disclosure. Of bad practices. And
by bostik 8y ago
I'm mildly surprised no-one has so far drawn the similarity to full-disclosure. Because let's be fair, this practice is full-disclosure.
Of bad practices.
And as we've seen over the past 2+ decades - FD works. Once you draw attention to an insecure system, resources to fix it will be found. (Enough of the time, at least.)
- gowld 8y agoThis is different from full disclosure because (1) in many cases the information is directly visible to the commmon user or publicly advertised by the company already, and (b) the insecurities aren't immediately directly exploitable (like plaintext passwords), just a risk factor in case of a hack.