3 ms·

No, that's not enough. I can provide examples in a non-public venue.

• mrep 8y ago
  Bold claim. If you can prove that, I'm sure google will give you a nice chrome security payout for letting them know. If they won't, why not pull a Google security style blog post exposing it?
  • bzbarsky 8y ago
    Google won't give me a payout for a problem they already know about. I know they know about it, because we have discussed it with them. In case it wasn't clear: I work on a web browser that is not Chrome. > why not pull a Google security style blog post exposing it Because I don't think publicly exposing specific security problems in shipping software is necessarily the right thing to do.
    • mrep 8y ago
      > Because I don't think publicly exposing specific security problems in shipping software is necessarily the right thing to do. I'm no security engineer, but isn't it best practice to expose security risks instead of letting them get knowingly exploited, especially if the parent company considers it designed as intended?
      • bzbarsky 8y ago
        It depends on the exact situation. In this case there is coordination happening among multiple vendors who are working on various fixes in this space, which complicates things. Also complicated is that apart from "don't use Chrome" there's no useful mitigation users can do for this risk, and most Chrome users would never see any security-related blog post, nor act on it if they did. There are times when "screw you, I'm going public with this" is in fact the right thing to do. Again, in this particular case I don't think it is.