Hacker News Reader

Comment by acangiano | Hacker News Reader

This is all fine and dandy but I actually find the approach taken by the professor in the first email to be quite unfriendly and perhaps even unprofessional. The guy from Websmart is actually right, there was no need to immediately contact his customers directly. You let the vendor handle the delicate subject with their customers and then take action directly (with a public disclosure) only if the vendor ignores you.

View on HN

Customers don't actually belong to anyone, you know. None of the vendors I have purchased products or services from have my permission to act as gatekeeper for communication with me, and as such have absolutely no right to act in that capacity. If I learned that a vendor had threatened someone for contacting me, that vendor would never receive another dime from me, and I would investigate whether I had any legal cause of action against that vendor.

Any notion that a third party could threaten someone for communicating with me, or even the notion that someone should go through a third party I have given no gatekeeping-like permission to, is offensive to my basic dignity as a human being.

This is best for the vendor, but not best for the customers. Vendors should have a healthy fear that if they don't provide substantial security they will be exposed for their lack of quality. Now, I hope I'm not soliciting a 'test' of my work by saying this...

To a certain degree, I do agree. If websmart can't do this right, I imagine there are many other security vulnerabilities plaguing client sites. I will say that, as a client, I would want to know this.

Technically the vendor responding is the only practical course of action. The customers are not likely going to abandon the software or patch it themselves.

This would only makes sense if the vendor didn't care. But even then its a long uphill battle.

I think that the issue of customer contact is a red-herring. What caused the issue was not that Sam contacted the customers, but that he cc'ed his threatening e-mail to the vendor to the vendor's customers.

Any reasonable person would expect the vendor to take umbrage to being threatened with press coverage in front of his customers. Sam would have had the best chance getting the problem fixed by sending a separate e-mail to the vendor that did not include a presumption of bad faith.

Reply on news.ycombinator.com