News for hackers. Stuff that matters.

A comment on LastPass release fix for DOM manipulation vulnerability. Parent comment

Re:LastPass release fix for DOM manipulation vulnerability by twhb on Saturday April 01, 2017 @06:47AM (#14011507)
You're forgetting the biggest factor: immediate disclosure also informs malicious parties.

What's really more dangerous, an extra week with a vulnerability that might be known, or two hours with a vulnerability everybody knows about?

Who's really more likely to see that disclosure on your personal Twitter account, every single (potentially non-technical) user of software you aren't even related to, or a few black hats who know you like to hack and brag?

Yes, it also makes companies look better, but in this case my anti-corporate agenda needs to take a back seat.

[ Parent | on HN ]
Re:LastPass release fix for DOM manipulation vulnerability by tokenizerrr on Saturday April 01, 2017 @08:32AM (#14011809)
Knowing a vulnerability exists is useless without a clue what direction to search. Read the tweets again.
[ Parent | on HN ]