2 ms·

These issues seem fairly obvious to me. Anyone interested in powerwall vulnerabilities would find them trivially. In this case I think the value is in embarra

• CivBase 7y ago
  > Anyone interested in powerwall vulnerabilities would find them trivially. What about those who become invested in powerwall vulnerabilities because they read an article on HN that showed how easy it is? > When you disclose such things quietly with the vendor, it mostly just saves their face. I don't see how. They still get put on blast for ever being vulnerable in the first place. If you're goal is to get them in more trouble at the expense of their consumers, then that seems like pretty irresponsible disclosure to me. > Not everyone values saving Tesla's face. And not everyone cares one way or another about Tesla. This is about responsible disclosure. It's about protecting the consumers. It has nothing to do with the vendor.
• marvin 7y ago
  It can also give you a five- or six-figure payout and prevent unsuspecting customers of being hit by a disrupting and damaging attack, causing unnecessary economic damage. IMHO, choosing the priority of embarrassing someone rather than give them a 24-hour window of notice to avoid this would be a shitty move. This should be short-term trivially fixable by pushing a password update that sets unique passwords based on a SN -> password mapping stored in a DB at the vendor. You don't need more than 24 hours to do that.
  • FeepingCreature 7y ago
    Not like they couldn't have done that before now.