3 ms·
Why is that more responsible than telling users?
by akerl_ 5y ago
Why is that more responsible than telling users?
- jmull 5y agoMaking it public before there's been a chance to fix it gives attackers a chance to exploit it. Now, those so inclined know to monitor shared vaults.
- akerl_ 5y agoAttackers don’t have to wait til it’s public to exploit it.
- quartz 5y agoThere's a whole concept of responsible disclosure[1] in white-hat security research that involves notifying the company and then notifying the public after giving the company a chance to fix the bug. It's generally understood to be the most ethical approach. [1] https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure https://en.wikipedia.org/wiki/Coordinated_vulnerability_disc...
- akerl_ 5y agoEven that page points out that “coordinated disclosure” is a more accurate term for what you’re describing. There are a wide variety of opinions in the industry about the merits of coordinated vs full disclosure. Calling one option “responsible disclosure”, or suggesting that it’s generally understood to be the most ethical, is outlandish.