5 ms·
> Because I don't think publicly exposing specific security problems in shipping software is necessarily the right thing to do. I'm no security engineer, but i
by mrep 8y ago
> Because I don't think publicly exposing specific security problems in shipping software is necessarily the right thing to do.
I'm no security engineer, but isn't it best practice to expose security risks instead of letting them get knowingly exploited, especially if the parent company considers it designed as intended?
- bzbarsky 8y agoIt depends on the exact situation. In this case there is coordination happening among multiple vendors who are working on various fixes in this space, which complicates things. Also complicated is that apart from "don't use Chrome" there's no useful mitigation users can do for this risk, and most Chrome users would never see any security-related blog post, nor act on it if they did. There are times when "screw you, I'm going public with this" is in fact the right thing to do. Again, in this particular case I don't think it is.