3 ms·
Completely agree. Look at his responses to the security issue being brought up in the original thread [1]. This is someone who is clearly playing fast and loose
by JoeCortopassi 14y ago
Completely agree. Look at his responses to the security issue being brought up in the original thread [1]. This is someone who is clearly playing fast and loose with some frameworks, and people's information, and does not deserve to be given that consideration.
In his own responses, he says that he won't email the users! I can't imagine how upset I would be if this had my information. Access control for something like this is dead simple
[1]http://news.ycombinator.com/item?id=4619424 http://news.ycombinator.com/item?id=4619424
- Silhouette 14y ago> In his own responses, he says that he won't email the users! If they're based almost anywhere in the US or EU, they might well have a legal obligation to notify at this point. (I am not your lawyer, etc.)
- taw9 14y agosomewhere, a low orbit ion cannon is warming...
- jfoster 14y agoBut the privacy of a security disclosure shouldn't just be based on the company responsible for it. It should also take into account the fact that users of that company's product could be harmed by a public disclosure. In this case I think the public disclosure would have two effects: 1. Put current users of the product at risk. 2. Prevent people from signing up for the product. So the question really becomes, does 1 outweigh 2, or vice-versa? (and the answer to that also depends on how cooperative & quick the company will be with a fix)