Re:macOS High Sierra: Anyone can login as “root” with empty ...
by azernik on Tuesday November 28, 2017 @08:11PM
(#15803601)
Forget the company. This harms users, who are not responsible for causing these issues; for all except the most technical 1% of Apple users, keeping the problem secret while Apple works on a quick patch is much more secure than telling the whole world immediately.
Re:macOS High Sierra: Anyone can login as “root” with empty ...
by flukus on Tuesday November 28, 2017 @09:52PM
(#15804147)
If it harms the company then they will take it more seriously and it will protect users more in future. If it doesn't harm the company then they have no incentive to change.
Re:macOS High Sierra: Anyone can login as “root” with empty ...
by rched on Tuesday November 28, 2017 @08:21PM
(#15803653)
This isn’t about what’s best for Apple it’s about what is best for users. The way this was disclosed was bad for users.
Re:macOS High Sierra: Anyone can login as “root” with empty ...
by saas_co_de on Tuesday November 28, 2017 @08:59PM
(#15803831)
In almost all cases immediate disclosure is better for end users who actually care about their security because they can take appropriate mitigation measures.
Just because the vulnerability is not disclosed does not mean it is not being actively exploited. It probably is.
Users who don't care about their security do not deserve to be "protected" at the expense of compromising the security of those who do care who benefit from immediate disclosure.
no one is under any obligation to sweep company's security problems under the rug for them.
If companies create incentives for people to share vulnerabilities with them first, great, but no one is under any obligation to participate in those programs.
Don't ship broken software if you don't want pie in your face.