News for hackers. Stuff that matters.

A comment on LastPass release fix for DOM manipulation vulnerability. Parent comment

Re:LastPass release fix for DOM manipulation vulnerability by foota on Saturday April 01, 2017 @12:08AM (#14010353)
Would you agree that the following series of actions is the most ethical way of reporting a vulnerability?

1. Inform the company of the vulnerability

2. Offer a limited disclosure of the vulnerability to the public/whomever you want, without giving away details of the vulnerability, as these would make an attack from an adversary more possible while the company fixes the bug.

3. After the company patches the bug, do whatever you want.

edit: I guess it would be important to ask this as well so we're not just going in circles, of the three general categories of ethical systems, would you say you prescribe to virtue, consequentialist, or deontological ethics?

[ Parent | on HN ]
Re:LastPass release fix for DOM manipulation vulnerability by tptacek on Saturday April 01, 2017 @12:25AM (#14010417)
No, of course I would not, for the reason I just stated. The ethics of disclosure are complicated and situational.

I am consequentialist in some situations and deontological in others, though I identify more strongly with deontological ethics.

[ Parent | on HN ]