Re:macOS High Sierra: Anyone can login as “root” with empty ...
by sjwright on Tuesday November 28, 2017 @09:45PM
(#15804120)
> I want to know so I can get in a fix or shut down that particular feature until its fixed by a vendor.
That assumes you can shut down that particular feature without crippling your business operations. If my system had a hole, I'd prefer that it were disclosed to the vendor before it's disclosed to hackers, adversaries and foreign governments.
Re:macOS High Sierra: Anyone can login as “root” with empty ...
by jachee on Tuesday November 28, 2017 @08:41PM
(#15803736)
So, if if find a security bug with your product, you prefer that I publish it directly to twitter as a 0-day?
Re:macOS High Sierra: Anyone can login as “root” with empty ...
by crankylinuxuser on Tuesday November 28, 2017 @09:38PM
(#15804077)
Yes. Ideally you would also ping me in your public release, so I know whom to pay. Because that would also for be the users benefit to know to either fix, firewall, or not use until software is deployed.
I've seen the dark side where this leads. It leads to BTC transactions and 0days bought and sold. That's the worst, further past scrappy company sitting on exploits.
I strongly believe in transparency. It empowers users and admins more than any other option out there.
Fixed that for you.
Sorry, I'm not going to cater to the lowest common denominator of "users". If my system has a hole, I want to know so I can get in a fix or shut down that particular feature until its fixed by a vendor.
Ive only 60k machines and 40 clients that depend on that decision. And they agree with me. If something's broke, I can analyse how it breaks and if it impacts us. If it does, we can triage it. I can do a damage assessment. I certainly can't do that if it's being sold on the darknets and whispered.