Hacker News Reader

From January, when management became aware of this particular vulnerability, until September I'd say is more then enough time make a patch. Management can and should be liable just as the attackers. IMO there is no difference, in this case, between them two parties.

View on HN

Apparently a lot of systems were backdoored in January (exploits were available before the patches), so even if the patches were installed right away the backdoor is still there [1]. The malware hackers are now slowly processing their long list of compromised systems.

[1] https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019...

So I get that the vulnerability should have been patched, but to say that management and the attackers are no different is quite frankly disgusting and a very dangerous thought to have. The attackers clearly had an intent to harm, even if financially, and to lump managers in with them as if they were the ones purposefully breaking the law is unconscionable. Negligent? Yes, perhaps, we don't know the facts. But criminal? Absolutely not.

Yes, it is criminal, defined by law. It's called manslaughter.

Reply on news.ycombinator.com