3 ms·

Doesn't seem like even Dell has learned from it. Hanno posted a few tweets that seem connected to today's Dell statement: "Dell has a publicly reachable secur

Doesn't seem like even Dell has learned from it. Hanno posted a few tweets that seem connected to today's Dell statement: "Dell has a publicly reachable security team. They just didn't answer when I contacted them about the eDellRoot." https://twitter.com/hanno/status/668856347455324160 https://twitter.com/hanno/status/668856347455324160 "I should repeat that: I contacted Dell's media team on 1st Nov and security team on 9th Nov about eDellRoot. No answer." https://twitter.com/hanno/status/668857466076180480 https://twitter.com/hanno/status/668857466076180480

jacquesm 11y ago
Why would he contact the media team first?
- mattlutze 11y ago
  Might get more visibility or traction if you get in touch with PR. Particularly if Dell has been less responsive in the past.
- hannob 11y ago
  I can just answer that myself. At first I didn't find a security contact on the Dell webpage. As I'm a journalist and as I investigated this issue to write an article (for Golem.de), the media contact was my logical next point to contact. Around a week later without a reply I saw that hackerone had a list of security contacts for large companies and found that there was a contact address for Dell there.
  - jacquesm 11y ago
    It's the 9th link when searching for 'dell security contact', but it is not on 'dell.com' so I can see how you missed that. There is a dell.com/security page but it lists all kinds of stuff and does not provide a security contact. Maybe every company should have a /security page with a contact? Or even a 'security.x.com' website as a first point of contact? Dell should probably instruct their personnel to forward any and all mail relating to potential security issues to the right department, but at the same time I don't feel that contacting their marketing department counts as the day the issue was properly reported.

jacquesm 11y ago

Why would he contact the media team first?

mattlutze 11y ago
Might get more visibility or traction if you get in touch with PR. Particularly if Dell has been less responsive in the past.
hannob 11y ago
I can just answer that myself. At first I didn't find a security contact on the Dell webpage. As I'm a journalist and as I investigated this issue to write an article (for Golem.de), the media contact was my logical next point to contact. Around a week later without a reply I saw that hackerone had a list of security contacts for large companies and found that there was a contact address for Dell there.
- jacquesm 11y ago
  It's the 9th link when searching for 'dell security contact', but it is not on 'dell.com' so I can see how you missed that. There is a dell.com/security page but it lists all kinds of stuff and does not provide a security contact. Maybe every company should have a /security page with a contact? Or even a 'security.x.com' website as a first point of contact? Dell should probably instruct their personnel to forward any and all mail relating to potential security issues to the right department, but at the same time I don't feel that contacting their marketing department counts as the day the issue was properly reported.