Hacker News Reader

So "threema's arrogance" on their website justifies that this person has to be arrogant him/herself disclosing this without responsible disclosure?

If you find 0 days and vulnerabilities you don't have to be a jerk about it. You are no better than the company making the "false" claims at that point.

View on HN

Full disclosure is the only responsible disclosure method. I am glad that they decided to be public about it.

1. Coordinated disclosure, not "responsible disclosure". Words matter.

2. Full disclosure is the preferred method for disclosing cryptographic weaknesses. https://www.schneier.com/essays/archives/2007/01/schneier_fu... Since Threema sells itself as a "private messaging" app, the general rule for cryptography applies.

3. Being "a jerk" is not the same thing as misleading users into a false sense of security. Saying I am "no better than" them is saying what I'm doing is equivalent or worse.

Reply on news.ycombinator.com