"They didn't announce it, they followed their internal policies which told them NOT to announce it. This is what people are upset about." You are reading - at

"They didn't announce it, they followed their internal policies which told them NOT to announce it. This is what people are upset about." You are reading - at this very second - a duplicate of a post linking to https://blog.google/technology/safety-security/project-strobe/ https://blog.google/technology/safety-security/project-strob... talking about this very security flaw. The announced it. Perhaps you think it should have been sooner? "Whenever user data may have been affected, we go beyond our legal requirements" Cool. So they usually do more than they're legally obligated to. This time they didn't, and various people/commentators are fetching their fainting salts. Regardless of whatever anonymous sources at the WSJ say, I really don't care about why they did it. They followed their legal obligations and - even more important to me - I have no ethical or professional issues with the way they managed the incident.