3 ms·
I flagged both of those at the time because it seemed more likely to be user error than anything. Bold claims like that need more evidence before publishing. O
by JeremyNT 4y ago
I flagged both of those at the time because it seemed more likely to be user error than anything. Bold claims like that need more evidence before publishing.
One thing that any programmer knows is that until you have a way to reproduce something in a clean environment, a bug report on its own cannot be fully trusted. That doesn't mean you ignore the possibility that the reporter is correct, because sometimes reproduction is very difficult indeed, but you have to allow for the fact that something about the user's environment or workflow unrelated to your own code might be at fault.
We are all susceptible to errors in our methodology or limitations in our understanding of how complex systems interact. We should be humble and careful about jumping to conclusions.
- lapcat 4y agoIn a now deleted tweet, the person was also ridiculing security researchers who were DMing him for more information, painting them as lazy, as if they hadn't tried to reproduce themselves. But nobody could reproduce the issue.
- merely-unlikely 4y ago""" lololol @ the "security researchers" sliding into my DMs asking me to run shell commands and send them the output Go run your Little Snitch and WireShark and tcpdump and mdimport and mitmproxy and system_profiler on yourself; I'm not your SOC. """ https://webcache.googleusercontent.com/search?q=cache:e2HBeu-pzTQJ:https://twitter.com/hodgesmr/status/1577655469690216448&cd=2&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:e2HBeu...
- eek2121 4y agouh wow. It goes without saying that you should know what the commands do before you run them and should not ask for help and then be hostile when people offer to help.
- PragmaticPulp 4y ago> We should be humble and careful about jumping to conclusions. Agreed, but it's also important to look out for confirmation bias. There were users on Twitter and even one HN commenter in the linked threads above who claimed to have reproduced the issue and verified the flaw. The HN commenter later updated their comment to admit their mistake. However, it's interesting to see how once the idea has been seeded, people are primed to accept any suggestion that it might be true.