OSNews

You do realize your money isn't actually stored in a large fault at your local bank?

If every customer of your bank came to collect their money there wouldn't be enough, far from it.

A thousand times: YES. Time and time again, companies have shown they will not fix security issues unless they are disclosed or threatened to be exposed. Security researchers are not the only ones that look for exploits. In fact most exploits are found after they have been exploited ( without any public disclosure by a security researcher). The public disclosure ensures that all stake holders have a better idea of the risks and can make better business decisions based on that; ie rewarding companies with good security and punishing those without good security.

I know I've posted this a few times here already, but since the same conversation keeps coming up here it is again:

http://www.schneier.com/blog/archives/2007/01/debating_full_d.html

Edited 2011-06-29 05:57 UTC

Apple has known since April 25th. People with criminal intent probably found this on there own and already know about it too. Apple's customers are the last to find out about it and they are the one's who suffer as a result of any criminals exploiting these issues.

The group discovered problems without breaking laws.
The group disclosed vulnerabilities to Apple directly so they could address them.
The group disclosing those vulnerabilities to the public after the grace period given to Apple allows the public to mitigate the risks or at least accept them with informed concent until Apple fixes the problems.

It is indeed ethical. Unethical would have been exploiting the vulnerabilities for criminal gain, not reporting them to Apple and not reporting them to the public when Apple failed to address them for the responsible protection of it's customers.

Look at it this way. I build a tree-house for my kids. Someone sees that parts or coming loose; kids could fall through the floor or be hit by falling parts. They report it to me "When I picked Jimmy up after the play date the other day, I noticed that the old tree-house needs some work."

Two months later I've done nothing to address the risk of injury. "look, I'm not comfortable with Jimmy visiting to play with your kids if they are going to be in or around that tree-house."

I still do nothing so they start telling friends who also have kids that come over to play with my kids.

One might call this responsible parenting versus alling children to get hurt by ignoring these known problems.


The real problem is that companies like Apple have more motivation to avoid the expense of fixing the "tree-house". It often takes public disclosure and proof of concept documentation to convince such companies that there is indeed risk of there customers being hurt when they come over to play. At minimum, customers can be aware of possible injury and take steps to protect themselves.