Timeline for Is browser history an important factor when considering security?
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 27, 2018 at 14:14 | comment | added | Tom | You misunderstood. A security issue is always relevant. Maybe not to you, or in typical settings, but there will always be at least one customer for whom it is relevant, and always at least one attacker who can leverage the issue into something more serious. Some things that people report are not security issues. But for these you can explain why (e.g. the check seems to be missing, but there is a check later in the chain). | |
| Jan 27, 2018 at 13:21 | comment | added | WoJ | (cont'd) and you will answer as "not applicable", "not relevant". Now - there are PLENTY of companies who completely fail to deal with their security, or misinterpret security reports. This does not mean that you should "never, ever" trust one who has an opinion different from yours. | |
| Jan 27, 2018 at 13:19 | comment | added | WoJ | I am not sure how much you deal with security reports, but I get a handful every week where the user has no idea about what he is talking about. Time permitting, I try to explain why the problem is not a problem - some get it and some do not. So yes - there are times when an answer of "not applicable" or "not relevant" is correct. If you "never, ever" trust such vendors then it means that you do not deal with good vendors, who can estimate accurately. This is particularly visible with bug bounties - if you ever run one publicly you will quickly change your mind when receiving some "reports". | |
| Jan 25, 2018 at 6:25 | history | answered | Tom | CC BY-SA 3.0 |