Now, the way I look at this is that WabiSabiLabi is not doing the responsible thing and disclosing it to the vendor. They are selling it. Basically trying to blackmail or hold the vulnerability for ransom.
I'm not of the opinion that everything needs to be disclosed to the public, but it should at least be disclosed to the vendor. If there is an exploit, and it's not being reported to the vendor, then it's irresponsible in my opinion.
WabiSabiLabi says this is their philosophy: "Wabi-sabi nurtures all that is authentic by acknowledging three simple realities: nothing lasts, nothing is finished, and nothing is perfect."
I can understand people trying to get paid for their research, but there is a certain line. They should apply for a job at the vendor or something. I don't know what the proper procedure is, but holding the vulnerability for ransom isn't fair.
If you are going to have a vulnerability, try to get the vendor to pay you for it. Or keep it to your damn self.
If you are interesting in paying into WabiSabi's coffers: 442.62 will get you a Quicktime exploit for Windows XP.
A small price to pay for Apple to ensure the security of it's customers.
No comments:
Post a Comment