18 ms·

> As for the company denying the issue this means nothing. It doesn't mean nothing - if the company themselves claim it's not an issue, then they're admitting

> As for the company denying the issue this means nothing. It doesn't mean nothing - if the company themselves claim it's not an issue, then they're admitting he didn't hack anything and didn't expose them to any risk by revealing the vulnerability. Because according to the company themselves, it "means nothing", so he just took them at their word. They can't have it both ways, claim it was nothing to avoid liability themselves, while also claiming it caused them great harm and he should be prosecuted. I will, perhaps, have a tiny bit of sympathy for the company, when attacks by companies on consumers via undisclosed spyware (they call it "telemetry") are treated in the same "raid the premises and confiscate everything" manner by the authorities.

radu_floricica 3y ago
I'm not sure if you're making an argument or just ranting. But in case it's an argument: the best behavior for the company is to say "ups, we fucked up", work with the hacker to fix the issue and maybe send some cash his way. The second best behavior is to deny the issue and work on fixing it. We didn't have a chance to see that, because 3 day deadline. It's even possible the initial denial was by a non-technical person, and it took more than 3 days to even escalate to somebody able to do something about it. We're not talking about just a guy with a laptop here, fixing this would most likely involve multiple people, both technical and non technical. Quite possibly somebody approving a budget and so on. That's why I said a 3-day deadline is hilarious.