4 ms·
Not sure how this is much different than posting a blog post about it.
by jshowa1 8y ago
Not sure how this is much different than posting a blog post about it.
- bhhaskin 8y agoI would say the difference is they sent the data to a 3rd party.
- bentona 8y agoTelling the operators first creates a situation where there is a reasonable chance that no one malicious will obtain the data. Publishing a public blog post greatly increases the chance the entire dataset will be leaked to the public.
- jshowa1 8y agoNearly all security vulnerabilities are published in blog posts at some point because most companies deny a problem even exists or needs to be fixed. Sometimes they just don't even respond and the person who discovered the vulnerability publishes anyways as a sort of "punishment" for the companies lack of response.
- kevinmchugh 8y agoThe researcher can only change the likelihood the data isn't obtained by a malicious actor if a malicious actor hasn't already obtained the data. The researcher usually has no way of telling if a malicious actor has the data. Optimizing for the worst-case scenario, which is yes, a black-hat hacker has already gotten there, it makes sense to prioritize notification of users by all available means so they can attempt to remediate the data loss.