"I can surround your child with dangerous unhealthy things and do my best to corrupt and poison them, there should be no limit to this behavior whatsoever because if I succeed it's your fault for being bad parents! All you have to do is say no, it's not like it's my full time job to make end-runs around you with the aid of behavioral science and psychology and a budget, no no no guiding your children morally is as simple as saying no once, are you too stupid and lazy to do that?".
There are a lot of parents that don't/can't say no. Those are the whales these advertisers are hunting for. The ones who's parents do say no and are "left out" or bullied are just collateral damage.
This example makes no sense to me. An attacker is potentially logging on to the computer and submitting empty passwords to get in. And this is what we're trying to prevent at the expense of having an unclear UX?
What kind of side channel exists if the behavior is: if password is required, zero length input is always invalid. This seems kind of like basic UX. I mean I wouldn't expect the password field to validate against the password complexity requirements exactly, just that zero length input is probably a mistake.
It's not an absolute statement, you'd have to have a childish interpretation of the article to have that takeaway. Not every generalization needs a "well actually".
Do you think Ubiquiti has hundreds of people on staff to watch their forums to triage every issue within seconds of it being posted? I'm curious what level of support would be satisfactory to you, in this instance.
Not OP but you don't need 100s of staff monitoring the forum. You need a webhook that filters on "security" in the title and post it in the relevant slack channel. I do expect UI have a 24/7 paid support/security team and I'm sure someone could say "uh, this looks real what's going on?"
Yes, damn those engineers for coming up with solutions to problems I personally believe are unsolvable based on nothing but personal feelings.
Ignoring the fact that flagging when certain keywords are posted is probably built into the forum software itself... I had that with phpbb back in 2001.
I just find it funny when engineers trivialize solutions that they themselves wouldn't employ. Like yeah, I'm sure your phpbb solution was a proper vulnerability reporting and triaging system.
