4 ms·

I wish people would actually think about issues before saying "false sense of security." It's as useless as shouting "that's security through obscurity!" witho

• emidln 11y ago
  The rationale for not releasing the PoC is that it gives legit users a chance to patch. This ignores the possibility of an attacker quickly developing an exploit as well as ignoring the scenario where bad actors already know and are exploiting the vulnerability. Not releasing PoC allows users think they have more time to patch than they actually do. This is a sense of security that is not actually derived from being secure in any way. What else should I call it? This also prevents users from being able to test their machines vulnerability after patching to verify that the patch remedies the problem in their installation. Again, apply the patch, hope that it works in my installation (with my config options) is a piss poor security policy.
  • danielweber 11y ago
    > Not releasing PoC allows users think they have more time to patch than they actually do This assumes a bunch of stuff about the psychology of everyone else that you cannot possibly know. You are making decisions for other people because you think you know their business better than they actually do. > This is a sense of security You are not a telepath who can read people's minds.