4 ms·
I would even say that full disclosure should be standard in such cases. If vulnerability is already exploited, some bad guys already know about it. Keeping it s
by mixedbit 13y ago
I would even say that full disclosure should be standard in such cases. If vulnerability is already exploited, some bad guys already know about it. Keeping it secret, even for a short time, gives these bad guys advantage and hurts users that can not take any extra precautions until the vulnerability is disclosed.
- gojomo 13y agoNot sure that follows, since 'bad guys' aren't monolithic. It may still be less damaging for only 'some' bad guys to be using the vulnerability, and continue to think that only they know it. (Thus, they use it sparingly). Immediate full disclosure means 'all' bad guys learn of the vulnerability, and then perhaps rush to maximally exploit (knowing they're in a race to use ASAP or lose their chance).