3 ms·
In Telegram case, the bug is really a minor severity. Unpopular client, hard to phish scenario. It's only in checkmark's interest to overhype the issue.
by homakov 10y ago
In Telegram case, the bug is really a minor severity. Unpopular client, hard to phish scenario. It's only in checkmark's interest to overhype the issue.
- mkagenius 10y agoI agree but Telegram's tone seem like they are unhackable, and they have checked for all possible scenarios and the mentioned scenario was overlooked as they had left only minor issues overlooked. They will feel the heat when an easy to exploit scenario comes up. I hope they own it properly before researchers publishes it.
- homakov 10y agoHow would you behave when someone finds hard to exploit XSS in rarely used Web client and tries to hype out yet another "completely hacked" story? I would have same annoyed tone too.
- mkagenius 10y agoAll this could have been avoided, had Telegram published the blog first. It's a common problem of companies not owning the vulnerabilities found in them and its understandable that they get scared owning them. But when it eventually comes out, they should talk like "yeah, there was silly xss not a big deal as the author said it to be, but yeah its there". That's it. There is no need to say "researcher wants PR" and "researcher is irresponsible".