> If an attacker can read memory out of a process containing sensitive data, the assumption should always be that they got the keys to the kingdom even if they

> If an attacker can read memory out of a process containing sensitive data, the assumption should always be that they got the keys to the kingdom even if they didn't We both agree on this. > but that they played chicken with an exploit and ended up on the wrong side of it. I disagree with this. They thought they had a valid technical solution and did the honourable thing by releasing it. Unfortunately they were wrong but that's a bug and not a arrogance issue.