I suppose if someone accidently left their door unlocked one morning, and you had a choice between phoning him at work to tell him, and announcing on the radio that Joe Bloggs in number 14 had left his door unlocked, only one of these would seem reasonable.

If Joe didn't bother doing anything about it for ages, and if he was storing something for friends of yours, then there might be a case for wider disclosure.

But in principle it seems reasonable to allow a *reasonably limited* amount of time for a fault to be fixed before making all details of the problem (and how to exploit it) public.

P.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/114/16781#16781