Re:Post from "weev" (AT&T/ipad data hacker) on his arrest an...
by ErrantX on Wednesday July 07, 2010 @09:53AM
(#1494173)
> It's not required, because disclosure is notification.
In this case it doesn't entirely work because it is trivial to recover in the information (so the disclosure/fix is hour sensitive rather than days sensitive)
Also, in Full Disclosure it is accepted ethical practice to notify the affected vendor and give them a reasonable time to fix it (In this case... I'd give them 2 days).
It is also very definitely not ethical to hand the data you got to the media. :)
In this case it doesn't entirely work because it is trivial to recover in the information (so the disclosure/fix is hour sensitive rather than days sensitive)
Also, in Full Disclosure it is accepted ethical practice to notify the affected vendor and give them a reasonable time to fix it (In this case... I'd give them 2 days).
It is also very definitely not ethical to hand the data you got to the media. :)