Comment on UPDATE YOUR BROWSERS IMMEDIATELY. RCE VULNERABILITY DISCOVERED

• towerful@programming.dev ⁨11⁩ ⁨months⁩ ago

  Nah, this bullshit is progress.
  The root of this problem has always existed. Exploits have always been there, mistakes have always been there. These things are fundamentally unavoidable.
  Acknowledging then, documenting them is new. Sensible disclosure is new. Companies paying for these bug bounties before they are publicly disclosed (so they can be fixed) is new.
  And it’s awesome. It’s security. It’s people working together for the betterment of everyone.

  It would be amazing if people didn’t make mistakes. But that isn’t possible.
  Openess, honesty and quickly remedying of issues is possible, and it’s laudable.

  So yeh, next time you get an annoying update that interrupts you’re workflow. Please understand the work and reason behind the update. You can still be pissed at the interruption, but please appreciate the human reason for it.

  source

  • cheese_greater@lemmy.world ⁨11⁩ ⁨months⁩ ago

    I def agree with the openess tenor of your reply. People and companies (since companies technically “are” people) need to stop valuing pride over security and safety and all the good stuff of life. Like, just fix the damn cancer, stop trying to hide it and cut off the progrssively more necrotic limbs to save face.

    We don’t disagree on anything, I was perhaps inelegant and non-specific in my invective.

    source

    • towerful@programming.dev ⁨11⁩ ⁨months⁩ ago

      since companies technically “are” people

      This wording is some legal loophole bullshit.
      I have tried to word something that disagrees with this for 30m. I can’t figure it out.
      This is bullshit.
      But this “company is person” tries to re-humanise corporations. I think. Or something.

      Have some ranting…

      A company is a group of people working in the interest of themselves.
      A person is generally working in the interest of themselves.
      A group of people always has more power than a single person, and thus should be held to a higher standard.

      It seems like Google is taking this seriously (assigning a 10.0. The next highest is an 8.8 for $15k). But it seems like the cve is still assigned to chrome, as opposed to libwebp (where the actual vulnerability is)

      source