4 ms·

This is a good point! However, the CIA surely has sufficient internal incentives to fix privately disclosed vulnerabilities. There is no need for "bad publicity

This is a good point! However, the CIA surely has sufficient internal incentives to fix privately disclosed vulnerabilities. There is no need for "bad publicity" to motivate them to become more secure. The CIA may even have already started working on fixes after Vault 7. Who knows? The only thing this action serves to do is allow less than trusted third parties abuse the weapons given to them (a possibility that the speaker clearly recognizes).

Buge 7y ago
> the CIA surely has sufficient internal incentives to fix privately disclosed vulnerabilities. Do they? Also various people could have different definitions of "sufficient". They might previously have had 3 people spending half their time on it, and this might cause them to increase it to 5 people working full time on it. Do major tech companies (Apple, Google, Microsoft) have less internal incentives than the CIA? This XSS vulnerability apparently took a year to be fixed: https://www.openbugbounty.org/reports/164180/ https://www.openbugbounty.org/reports/164180/