Re:How I recorded user behaviour on my competitor’s websites
by bdamm on Thursday August 23, 2018 @11:45AM
(#17828203)
Right; but sometimes someone is the first to have an idea or realize a vulnerability, even if it seems trivial to them. Once it's public, novelty is no longer a factor, and it is a good idea to allow the vendor a chance to remove that vulnerability before the novelty is clearly eliminated. Obscurity does actually matter in the real world, even though it is a useless design principle.
[ Parent
| on HN ]
Re:How I recorded user behaviour on my competitor’s websites
by C4stor on Friday August 24, 2018 @09:59AM
(#17834960)
That's right.
But while there are a lot of domain where I don't accept the reasoning "someone else must have thought about this before", finding vulnerabilities is somewhere where I can't help but believe that every publicly disclosed vuln has probably been secretly exploited and sold for years.
(The only data point I have behind that is that there are nations level agencies pretty much dedicated to finding those, and they've gotten really good at this (cf Stuxnet !)).
So, while by conviction only, I highly doubt any independent white/gray hat vuln finder will ever be the first to find it, and I applaud any kind of disclosure.
Re:How I recorded user behaviour on my competitor’s websites
by bdamm on Saturday August 25, 2018 @04:09PM
(#17842358)
Yes, the reveal is required. But it doesn’t have to be without the vendor’s knowledge. The rush to get it out without allowing the vendor to respond is unjustified and reckless. The TLAs using the vuln are keeping it a secret, after all, and the script kiddies enjoy public trashing of people which I think is worse than the TLAs careful abuse.