4 ms·

They believed that they were covered and that no compromise could/did occur. It's a mistake they now acknowledge but they have owned up to it and are taking act

• daeken 13y ago
  > I believe their actions are honest and completely reasonable. If they had known they still had an issue I seriously doubt they would have publicised the patch and risk the issue they now have. I completely agree that their actions are honest, and I seriously doubt they would have played things this way if they knew their protections were faulty. I'm not saying that they're acting maliciously; I'm saying that they acted in an arrogant and irresponsible way. If an attacker can read memory out of a process containing sensitive data, the assumption should always be that they got the keys to the kingdom even if they didn't. I'm not saying they didn't do their best to defend their service -- on the contrary, I think that their defense is a good one -- but that they played chicken with an exploit and ended up on the wrong side of it. Their customers deserved better.
  • Narkov 13y ago
    > If an attacker can read memory out of a process containing sensitive data, the assumption should always be that they got the keys to the kingdom even if they didn't We both agree on this. > but that they played chicken with an exploit and ended up on the wrong side of it. I disagree with this. They thought they had a valid technical solution and did the honourable thing by releasing it. Unfortunately they were wrong but that's a bug and not a arrogance issue.