29 ms·
This seemingly makes no sense and yet it is far from the only case I have come across. If ever you find yourself discovering a security flaw then just pretend
by SeanDav 13y ago
This seemingly makes no sense and yet it is far from the only case I have come across.
If ever you find yourself discovering a security flaw then just pretend you never discovered it and tell no one. If you really want to be a concerned citizen - report it anonymously.
- deleted 13y ago[deleted]
- droithomme 13y agoThis is my position as well. History is replete with examples of people being punished harshly for reporting security problems. In the Randal Schwartz case, discussed in a link above, he was working for Intel and doing routine best practices security testing there that got him arrested and convicted. So even if you are working with complete authorization, if you have political enemies or just clueless people around, they can make the argument that you are the bad guy. So stay quiet and let the real bad guys figure it out. There are also many who make reasonable incomes selling exploits on the black market.