Quote:
Originally Posted by Shaggy
The reports are suggesting that Goatse obtained the email addresses, is that not correct?
There's a difference between discovering a vulnerability and notifying the company, versus actually making use of that vulnerability to download data. Or are the media reports wrong (wouldn't surprise me) and they never did the second part?
|
Well, obviously. To prove something is a vulnerability one needs to show that such things can be obtained. As you undoubtedly read in the article:
Quote:
|
We disclosed only to a single journalist and destroyed the data afterward.
|
What less could they do to prove to the world the vulnerability exists, when the company ignored the notice?