> These questions imply the onus is on reporters of problems. Sorry, I did not mean to imply that and disagree with that statement. The problems are what they

> These questions imply the onus is on reporters of problems. Sorry, I did not mean to imply that and disagree with that statement. The problems are what they are. Fixing them is not the job of whoever encounters a security vulnerability. Yet if you encounter one, you still have to decide what to do. I encountered one in an Apple service a couple of years ago. Reported it. Never heard back. Vulnerability was still there 6 months afterwards, but I have better things to do than chase them. The action I took was simply to stop using Apple's products. But that was probably the wrong decision in hinsight, since the alternatives aren't really better.