The reality is that no for-profit company holds its customer's best interest in the highest regard. The customer's best interest are a means to the primary purpose, which is to provide profit or value to its owners or shareholders.

A corporate CEO is not accountable to customers, he/she is accountable to a Board of Directors or owner.

In that environment, why would any VP or mid-level executive indicate that they must spend X amount of time fixing something that isn't public known, and only has limited exposure internally? There is no fiscal incentive to do so, unless that vulnerability is released. Then there is the fiscal incentive of not losing customers.

McDaniel was completely justified in his response to Tornado's inaction. Now if he stole e-mail lists, that's punishable, but just writing e-mail to someone offering them information shouldn't be illegal. If it is, stop sending me snail junk mail!


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/179/21582#21582