Another banger from @flyingpenguin regarding the Mozilla statements re: Mythos.

[mttaggart@infosec.exchange]

Another banger from @flyingpenguin regarding the Mozilla statements re: Mythos.

Science publishes methods. Science is transparent. Mozilla did the opposite by writing outcomes and skipping straight to saying readers should adopt the approach. Why? Based on what, exactly? If they don’t invite scrutiny, and pull back the curtain, they are peddling hopes and prayers.

Amen.

https://www.flyingpenguin.com/could-mozilla-security-hot-air-fill-mythos-sails/

[sharkfie@infosec.exchange]

@mttaggart @flyingpenguin

"To be clear. Real bugs are real. Faster fixes help fix. It’s the hand-wavy self-dealing capability claim that makes the missing study somehow turn into this logically flawed press release."

As an aside, while this Mythos doomsday marketing is put into place there have been major bugs found by lesser known companies. It amuses (the situation, not the bugs) me that their plan might backfire due to it.

[aakl@infosec.exchange]

@mttaggart @flyingpenguin The more I read about Mozilla's "yay, our magic wand found this many bugs," the more it reeks of its desperation to rediscover its raison d'etre with very questionable results.