[michaelt]

> If the system is configured to "fail open", and it's something validating access (say anti-fraud),

The problem here isn't the DoS, it's the fail open design.

[jpollock]

If the majority of your customers are good, failing closed will cost more than the fraud during the anti-fraud system's downtime.

[prmoustache]

If that is the mindset in your company, why even bother looking for vulnerabilities?

[everforward]

You are really running with scissors there. If anyone with less scrupulous morals notices, you’re an outage away from being in deep, deep shit.

The best case is having your credit card processing fees like quadruple, and the worst case is being in a regulated industry and having to explain to regulators why you knowingly allowed a ton of transactions with 0 due diligence.

[lazyasciiart]

Until any bad customer learns about the fail-open.

[paulddraper]

Okay, then the “vulnerability” is de facto simply transitioning the system to an acceptable state.