unix

Every time I hear about a new vulnerability that an ethical hacker has discovered and explained to the vendor of the device or software, I'm annoyed anew by the refusal or inability of companies to take responsibility and fix the things that are broken. When someone who cares enough to contact you and tell you what's broken so that you can fix it, why would just ignore them?

The usual answer is that the vulnerability is seen as less costly than the fix, so there's no point in fixing it. In most cases, this is a shamefully short sighted view of the situation that doesn't take the full cost of the problem into perspective. The company is only looking at their own costs, not at the full range of costs to themselves and their customers.

"But, of course!" you say. "Everyone is looking out for their own interests. That's obvious!!"

What happened to enlightened self interest? It seems as if our entire culture has lost sight of this very vital part of communal interaction. I could go on and on about the problem for days, but just now I'd like to point out how it fits here.