2 ms·
The "then" isn't temporally proximal. The quoted e-mails (unless you feel like asserting that they're fake, which I think is the next step in your arguments in
by dogecoinbase 11y ago
The "then" isn't temporally proximal. The quoted e-mails (unless you feel like asserting that they're fake, which I think is the next step in your arguments in this thread) demonstrate that he's trying to work within the unwritten rules of the program and asking for clarification in good faith. Then after that, rather than attempting any communication with his, Stamos threatens his employment.
I agree with you that something seems off, but you're happily giving all the charity to FB and none to this guy, which is your prerogative but hardly makes for good conversation.
- tptacek 11y agoRead the timeline again and then the post. 1. Second finding is declined. 2. New third finding, which includes AWS credentials that this person should not have had, is written and submitted. 3. Stamos calls Synack. I believe the relative timing of these events is, in fact, established. Now: stipulate that I'm right, even if you're not sure. Does your opinion of the story change?
- dogecoinbase 11y agoNot really, no. Your should not have had is still presupposing a set of bug-bounty-hunter-professional-guidelines that don't actually exist unless they're specified in the program guidelines, and from a philosophical perspective the actual security vulnerability under discussion now is that their sec team is so lackluster that they can't or won't change out a credential set known to have been externally accessible (and, the critical point, to anyone who could have found this not-particularly-obscure vuln, not just this researcher).