I've avoided this answer before, I honestly did, but I need to dump it now. First of all, the only thing we knew was that the bug involved the friends list. The friends list in my opinion is sensitive information and personal. Information you trust to PSN (in my case) and Bungie, therefore they should keep it safe. You don't know the impact of such bug neither potential exploits. If this bug included security issues, they did well not to disclose it to minimize exploitation and protect their user base. If you dont know, then I tell you now. When a security researcher finds a security bug that can be exploitable and considered critical (affects the vast majority of instalations) it is solved away from the general public, patches are published, there is time given to providers to release updates and only then the bug is made public. This is standard procedure in any decent organization. This is the right way. Are you aware that a small bullshit like 'heartbleed' could do potential damage. Would you like that any single retard could have access to the exploit or proof of concept before everyone had the updates installed? Would you like to see your information in a database on the darknet ? You don't need to know more. Leave this issues for the professionals, because clearly you don't know jack about the implications your bullshit might bring to other people. Crawl back to the cave hence you came from.