ZFX operated as a . They published the vulnerability details (with a 48-hour warning to the vendor) before a fix was available. The reasoning was ethical but controversial: ZFX argued that the risk of publishers unknowingly leaking source data was so severe that the public had a right to know immediately.
Stay tuned for our follow-up piece: "ZFX Part 2: The Unpatched WebSocket Stream."
For the rest of us, ZFX’s work is a reminder that in the digital age, the person protecting your privacy might not be a cybersecurity firm. It might just be a reporter with a laptop and a hunch.
