[dspillett]

I read that post as him talking about their company, in the sense of the company they were working for. If that was the case, then an exploit of an unfixed security issue could very much affect them either just as part of the company if the fallout is enough to massively harm business, or specifically if they had not properly documented their concerns so “we didn't know” could be the excuse from above and they could be blamed for not adequately communicating the problem.

For an external company “not your company, not your problem” for security issues is not a good moral position IMO. “I can't risk the fallout in my direction that I'm pretty sure will result from this” is more understandable because of how often you see whistle-blowers getting black-listed, but I'd still have a major battle with the pernickety prick that is my conscience¹ and it would likely win out in the end.

[1] oh, the things I could do if it wasn't for conscience and empathy :)

[calvinmorrison]

No i mean, 'a company you own'. At the end of the day you're just a worker getting paid to produce output. cross your I's and dot your T's and whatever else and then clock out.

[dspillett]

Even keeping to the 9-to-5 you can make your displeasure at being insecure know. And if the security issues come to a head and it damages the company, you could be out on your arse if the company dies or needs to cut costs. In the current environment is a lot worse than it would have been five or ten years ago, and that same environment likely limits the “I don't like it so I'll just leave” options that are available.

I'm lucky, I have options¹ and it is looking like I don't need them²³, but many are not so lucky.

--------

[1] I made serious enquiries about a couple of them when the recent take-over was announced, just in case…

[2] the new corporate masters seem to be doing more than talking the talk, and on quality matters we were already doing things right and the new overlords don't appear to have any desire to change that

[3] well, at least not on these matters, there are a few cultural changes that I need to get used to or get away from, largely due to being a bigger organisation now, but they aren't wrong just a little further from my preference than things were before.