Timeline for Raised concerns about a security vulnerability to various managers, for more than a year, with no results. Should I mention it to external auditors?
Current License: CC BY-SA 4.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 16, 2020 at 10:59 | history | edited | CommunityBot |
Commonmark migration
|
|
| Nov 16, 2019 at 20:58 | comment | added | msouth | The question is what is the right thing. Not whether to do the right thing. Suppose you know about a problem that would make your company fail the audit. The auditors don't catch it. You bring it up of your own accord. The audit fails, everyone loses their jobs because the company loses a critical contract. What is the "right" thing here? I think it's "keep your mouth shut around the auditors and continue to work on it internally". This vulnerability may never be exploited, after all. We are not omniscient. | |
| Nov 15, 2019 at 7:52 | history | answered | user111776 | CC BY-SA 4.0 |