4 ms·
How does this not result in FortiNet customers suing, to say nothing of shareholders and the FTC? To intentionally design an insecure obfuscation for customer
by zaroth 7y ago
How does this not result in FortiNet customers suing, to say nothing of shareholders and the FTC?
To intentionally design an insecure obfuscation for customer confidential traffic, and then keep it in place for a year and a half after someone discovers and reports it, is obviously negligent and causes real damage to the companies who bought this defective product.
- NedIsakoff 7y agoThat's why you pay your legal time extra money to write a good "Terms of Services".
- zaroth 7y agoDeceptive business practices can't be over-ruled by Terms of Service.
- precurse 7y agoThey won't even create a fix for their software after blatantly disabling TLS server validation in their FortiSIEM product: https://packetstormsecurity.com/files/154702/Fortinet-FortiSIEM-5.0-5.2.1-Improper-Certification-Validation.html https://packetstormsecurity.com/files/154702/Fortinet-FortiS... They use the "-k" curl flag throughout their code (disabling ALL certificate validation), since I assume is to make initial configuration easier. Rather than fix this going forward, they created a workaround document which all new and existing customers need to follow to secure their setup.