4 ms·
I'm disappointed by the response he got which said "This appears to be more of a risk acceptance rather than a vulnerability." I understand that some risk is
by robbick 8y ago
I'm disappointed by the response he got which said
"This appears to be more of a risk acceptance rather than a vulnerability."
I understand that some risk is acceptable but surely that is proportional to the cost of removing the risk and in this case that cost is so small.
- laurent123456 8y agoI agree that it should be fixed but we can't know that the cost is going to be small. Some websites are generated via dozens of layers of abtractions and maybe there's no options to add the sri without going deep inside some messy frameworks and changing several of these layers.
- dragonwriter 8y agoAlso, “risk acceptance” and “vulnerability” aren't mutually exclusive. Vulnerability is the risk, the acceptance is deciding that the vulnerability is necessary because the cost to avoid or fix it is too high. But making that choice doesn't stop it from being a vulnerability.
- JustSomeNobody 8y agoI read that and translated it to, "This is between our customers and their credit card company. It's not like we'll get in any real trouble."