21 ms·

Yeah, the disclosure comes close to violating their own Responsible Disclosure policy, which is 3 business days. If McDonald's enployees get the holidays off a

by kdazzle 10y ago

Yeah, the disclosure comes close to violating their own Responsible Disclosure policy, which is 3 business days. If McDonald's enployees get the holidays off and go back to work on the 3rd, they would have had 2 days to respond. Meaning that if McDonald's disclosed a vulnerabilty to Finnwea.com over the same time period, finnwea.com says they might have sued them. So maybe that guy was a little trigger happy. Great hack, though.

sneak 10y ago
Yes, because a company at #109 on the Fortune 500 shouldn't bother spending money on 24/7 infosec. "Responsible disclosure" is simply a meme to reframe "instant full disclosure" as irresponsible, which is dishonest. Do you think journalists sit on the final results of corporate negligence investigations while giving the guilty parties time to clean up their act? Look at this bug, in particular. This is not about this bug; this is about basic negligence. It would have been completely appropriate to blog about this on day zero of discovery. This is not about "time to patch", this is about "time to convince the widest number of people that you should never trust McDonalds with your data".
- ceejayoz 10y ago
  > Do you think journalists sit on the final results of corporate negligence investigations while giving the guilty parties time to clean up their act? I've worked at a newspaper. Your framing of the question is deliberately silly - they'd sit on it to prevent innocents from being harmed, not to protect the guilty. Once it's fixed (or after a reasonable amount of time not getting fixed), then they happily nail the guilty people to the wall.
nmstoker 10y ago
I could be wrong but it sounds like your comment is confused about what a business day is. If a firm decides to let some individuals have the whole time off during the holiday period, that doesn't mean those aren't business days from an external perspective.

by kdazzle 10y ago

sneak 10y ago

Yes, because a company at #109 on the Fortune 500 shouldn't bother spending money on 24/7 infosec. "Responsible disclosure" is simply a meme to reframe "instant full disclosure" as irresponsible, which is dishonest. Do you think journalists sit on the final results of corporate negligence investigations while giving the guilty parties time to clean up their act? Look at this bug, in particular. This is not about this bug; this is about basic negligence. It would have been completely appropriate to blog about this on day zero of discovery. This is not about "time to patch", this is about "time to convince the widest number of people that you should never trust McDonalds with your data".

ceejayoz 10y ago
> Do you think journalists sit on the final results of corporate negligence investigations while giving the guilty parties time to clean up their act? I've worked at a newspaper. Your framing of the question is deliberately silly - they'd sit on it to prevent innocents from being harmed, not to protect the guilty. Once it's fixed (or after a reasonable amount of time not getting fixed), then they happily nail the guilty people to the wall.

nmstoker 10y ago

I could be wrong but it sounds like your comment is confused about what a business day is. If a firm decides to let some individuals have the whole time off during the holiday period, that doesn't mean those aren't business days from an external perspective.