> The same issue was submitted to our program earlier this year, but we were not able to reproduce the vulnerability. When you submitted your report, we were able to identify and reproduce the issue and began developing a fix.
I wonder if it really was the same bug or what they did wrong to reproduce it. Or maybe they just made some mistake in reproducing it.
The refactor that’s mentioned towards the end of the article is great, but would you not just get a fix out there as soon as possible, then work on a good fix after that? For a company that claims to lead the way in bug bounty programs this is a pretty disappointing story.
It's not 'cruel' for any administration to indicate basic realities without some arbitrary historical and legal context.
While we should be eternally vigilant and skeptical, the lack of very specific context in this case is nowhere near a blatant manipulation.
In fact, I would say the 'problem' is maybe the opposite - I am somewhat more skeptical that this is a 'Musk led personal intervention' to draw arbitrary cynicism towards a political entity he does not like - playing 'moral equivalence' games with people who say "The economy is doing good!" (without nuanced context) and "I won the election!" (without the obvious 'context' that the statement is literally false, or blatantly misleading).
That said, it's just skepticism, I really can't say one way or the other obviously.
There's clearly a grey threshold in what we can tolerate from government and political statements, and it's very hard to fathom where that line is - but this one is not near that line.
If any administration wants to claim "Lowest unemployment ever!" in a Tweet, well then that's fine. They can say that as long as it's true, a history lesson is not needed in this case.
In any case, if they are going to do this, they need a set of publicly stated criteria for it, and they need to apply the criteria objectively and consistently.
Perhaps a better solution is to create a small chip powered by electric induction. The chip would have an embedded private key and solve challenge-response queries issued by the scanning device.
I'm not sure how that compares in cost though.
Edit: it looks like these already exist and cost less than 10 cents a piece. They are called NFC tags.