hatter

> My ... business are not any less ... valuable than anyone else's,

Plainly untrue. The reason they keep distribution minimal is to maximise the chance of keeping the vuln secret. Your business is plainly less valuable than google, than walmart, than godaddy, than BoA. Maybe you're some big cheese with a big reputation to keep, but seeing as you're feeling excluded, I guess these orgs have no more reason to trust you than they have to trust me, or hundreds of thousands of others who want to know. If they let you in, they'd let all the others in, and odds are greatly increased that now your customers are at risk from something one of these others has worked out, and either blabbed about or has themselves a reason to exploit it.

Similarly plainly, by disclosing to 100 major companies, they protect a vast breadth of consumers/customer-businesses of these major companies at a risk of 10,000,000/100 (or even less, given they may have more valuable reputation to keep). Changing that risk to 12,000,000/10,000 is, well, a risk they don't feel is worth taking.

You invested (your time, energy, reputation) into a system which you either knew or could have quickly established, places no value in you as a person and has zero interest in fixing any problems that may affect you. I'm sure many users started using it for nothing of any real importance at first, so didn't let that really worry them. But over time, they invested much more while still in the back of their mind knowing that while the odds are small of anything happening, that if it did, your data and relationships could be taken from you, and possibly even given to others, for reasons you may never even know, or reasons you may know to be false but unable to do anything about the error.

Much like the folk putting echos into find and wildcarded shell commands to check the output, I'll often start manual sql updates by doing 'SELECT something FROM database WHERE...' and check the output rows match my expectations before hitting the up arrow to replace the SELECT with an UPDATE.

For bigger tables, I use COUNT(something) if I expect it to be long but I have an idea of rows affected, or LIMIT if that's going to give me an idea that it's doing the right thing.