2 ms·
So "threema's arrogance" on their website justifies that this person has to be arrogant him/herself disclosing this without responsible disclosure? If you find
by sschueller 5y ago
So "threema's arrogance" on their website justifies that this person has to be arrogant him/herself disclosing this without responsible disclosure?
If you find 0 days and vulnerabilities you don't have to be a jerk about it. You are no better than the company making the "false" claims at that point.
- some_furry 5y ago1. Coordinated disclosure, not "responsible disclosure". Words matter. 2. Full disclosure is the preferred method for disclosing cryptographic weaknesses. https://www.schneier.com/essays/archives/2007/01/schneier_full_disclo.html https://www.schneier.com/essays/archives/2007/01/schneier_fu... Since Threema sells itself as a "private messaging" app, the general rule for cryptography applies. 3. Being "a jerk" is not the same thing as misleading users into a false sense of security. Saying I am "no better than" them is saying what I'm doing is equivalent or worse.
- ttybird 5y agoFull disclosure is the only responsible disclosure method. I am glad that they decided to be public about it.