7 ms·
Responsible disclosure makes sense when the user and the manufacturer have the same goal of the product being secure. Jailbreaking is a case where the user and
by mort96 9d ago
Responsible disclosure makes sense when the user and the manufacturer have the same goal of the product being secure. Jailbreaking is a case where the user and the manufacturer have opposing goals: the user wants to be in charge their hardware, the manufacturer wants to prevent the user from being in charge of their own hardware. Responsible disclosure doesn't make sense, the manufacturer would just patch the vulnerability before users could use it.
If manufacturers had a sanctioned way for the user to get root access to their own hardware, responsible disclosure would've made sense, but as it is, vulnerabilities are a useful tool for the owner of the device.
- rcxdude 9d agoExactly. This control-freak nature of manufacturers is sadly what makes me cheer for the security holes much of the time.
- p0lychromatic 9d agoYet here we are, in this thread, discussing why LG is spying on us. While some stuff are legit issues such as ADR, people now think they are wire-tapping. Because somebody used a rooted device to show-case recording silently through their device. Can you blame corporations having this control-freak nature when shit like this happens? It's stuff like this that likely pushes corporations now to invest more into device security, and locking down their stuff more. Good for security and the corporation. Maybe mid-term good for you consumer, because they might get more cautious with tracking stuff. But long-term bad for you consumer, too, because they will make sure to lock down their devices better.
- mort96 9d agoThe best solution is obviously sanctioned rooting so that vulnerabilities can be freely shared with manufacturers and fixed. But that's not going to happen.
- rcxdude 9d agoThe solution to misleading reports about your software isn't more opacity, though, quite the opposite. If they were transparent about what they were doing then there would be much less room for speculation and misleading reports. (And yeah, as pointed out by another comment, if you officially allow users full control of their devices, you are less likely to have people sitting on undisclosed exploits so that they can get it without your help, and as a bonus you have an easier argument for why you are not liable for what someone does with that control)
- croon 9d ago> While some stuff are legit issues such as ADR, people now think they are wire-tapping. Because somebody used a rooted device to show-case recording silently through their device. > Can you blame corporations having this control-freak nature when shit like this happens? Is "shit like this" referring to the corporation spying on the user, or the user discovering it? Because one happened before the other, and so impossibly could have caused the former. > It's stuff like this that likely pushes corporations now to invest more into device security, and locking down their stuff more. Or they could just sell the device users want, and not sell their users.
- rickdeckard 9d agoTo me as a user, responsible disclosure is most-valuable for every vulnerability that could be exploited remotely without me being in control. The video draws exactly that picture, a nefarious actor, remotely taking control over my TV and recording Audio from it
- mort96 9d agoTo me as a user, responsible disclosure takes away my right to do what I want with my hardware.