3 ms·
> At that scale, it would take years to get fixed without forcing it like this. But it also might not take years. The point of responsible disclosure is to giv
by loktarogar 2y ago
> At that scale, it would take years to get fixed without forcing it like this.
But it also might not take years. The point of responsible disclosure is to give them the opportunity. If they don't take it, fine - that's now on them.
Instead this guy is committing fraud with actual financial damages (wasted food) and then sharing how others can commit the same fraud on a massive scale, potentially causing more damage. This is now on him and Dotpe, not Dotpe alone.
- hunter2_ 2y ago> fine - that's now on them Is that legally true? The legal risk of having published this without responsible disclosure vanishes if the conventional period of opportunity is ignored? That smells fishy.
- loktarogar 2y agoI'm not a lawyer so I'm not speaking to the legality of this. Legality is not the only thing that matters. If you publish an exploit without at least making an attempt to fix it, and someone follows you and exploits it, then there's a direct moral line between you and that exploitation. They more likely than not wouldn't have exploited it without you putting that published info in their path. It's now on you, them and the company, morally. Any damages that result from this interaction are because you and the company enabled them to happen. That's different to someone else stumbling on it and exploiting it. That's purely on the company and the exploiter.