Re:LastPass release fix for DOM manipulation vulnerability
by godelski on Saturday April 01, 2017 @01:56AM
(#14010725)
>If you feel that the vulnerability is big, and the company is taking it seriously enough, you give them an honest chance, otherwise if they slack or hum and haw, you go to the public.
This. I fully agree with this. Obscurity is a good form of security in a temporary sense. But vulnerabilities should ALWAYS be disclosed to the public, for a number of reasons. The question is when. Disclosing does a couple things: 1) We see a company fixes them in a timely manner, which gives us trust in services that we use (and the opposite if they fail to) 2) other companies don't make the same mistakes because now the vulnerability is googleable and quickly becoming public knowledge.
This. I fully agree with this. Obscurity is a good form of security in a temporary sense. But vulnerabilities should ALWAYS be disclosed to the public, for a number of reasons. The question is when. Disclosing does a couple things: 1) We see a company fixes them in a timely manner, which gives us trust in services that we use (and the opposite if they fail to) 2) other companies don't make the same mistakes because now the vulnerability is googleable and quickly becoming public knowledge.