Official Policy: When Security Vulnerabilities in Hacks are Found

[Erwin]

Originally Posted by Reeve of shinra

I think this is a double edged sword. I kind of agree with everything here but at the same time I think the nature of the vulnerability should be made known to the people that have installed it at least. Perhaps some of them can patch it.

The better question is what if its not a serious vulnerability or if its an issue that would only affect a specific yet minor group? Like say people running the hack on ISS would be vulnerable but on apache it wouldn't or something.

? Like say for instance it only affects a

We will decide what to tell the users who installed it. You can appreciate the fact that some people may click install but have not installed it just to keep updates of when a vulnerability is found, and then if they know what it is, to take advantage of it.

Members who we trust who contact us may be given full information though. It's a case by case thing - we can't make rules for every case but we can make general protocols.