3 ms·

> it appears they didn't alert the companies or the public to these weaknesses. That potentially put millions of users in danger of their data being accessed by

by Canada 11y ago

> it appears they didn't alert the companies or the public to these weaknesses. That potentially put millions of users in danger of their data being accessed by other governments' agencies, hackers or criminals. I don't care if the bug finder is a white hat researcher or a spy working for NSA: It's the writer of the bug who puts the user in danger, not the finder of it.

shkkmo 11y ago
It's not an either/or. The behavior of the bug finder directly impacts the amount of danger end users are put in. Selling 0 day exploits also puts the user in more danger. Posting exploits publicly without attempting to notify the maintainer also puts the user in more danger. Keeping exploits secret also puts the user in more danger (though less than selling them).