• 2 Posts
  • 46 Comments
Joined 1 year ago
cake
Cake day: January 6th, 2024

help-circle







  • no obligation to help (unlike literally all of your examples)

    How are my other examples obligated to help? They can find a different occupation if they have children that would lose a parent if something happened while they were on the job.

    She ran away from her family like a coward to get out of dealing with them, to play soldier and be used as a bad PR piece.

    You know that how? Did she say so? Or is it your interpretation of her situation?

    If she’d prefer not to be in that situation, she had every ability not to be

    Oh yeah, it’s super easy to get out of a moral dilemma. Sorry, must’ve slipped my mind.



  • It sounds like she’s very upset that Dansup made it explicit that he was fixing this issue, thinking that even exposing it in commit comments (which as we know get way more readership than blog posts) would mean people knew about it, and the less people that knew about it, the safer her partner’s information would be since she is continuing to do this apparently. You will not be surprised to discover that I think that type of thinking is also a mistake.

    I agreed with you at first because from your description it sounded like she was saying security through obscurity was a good thing. But that’s not the case.

    What she’s saying in the blog post is that this a 0-day and should be handled according to the best practices for 0-day disclosure.

    You have to decide if you want to

    • publish the findings before the fix -> more people will know and exploit the vulnerability but users might be aware and may or may not be able to mitigate sharing even more
    • publish the findings after the fix -> the opposite

    I don’t pretend to know enough to judge which option is the best. But I can’t fault the blog author for pointing out that Dansup didn’t follow best practices.