3 ms·

while, yes I did want to make out in the second half just how difficult it was to get in contact with a CERT, it's sad to hear the other half put down to 'alrig

while, yes I did want to make out in the second half just how difficult it was to get in contact with a CERT, it's sad to hear the other half put down to 'alright findings'... Sure, the first issue that made me get into tax bug hunting was a run-of-the-mill open redirect, but the second issue is an interesting DOMXSS in an obfuscated vendor codebase with a WAF bypass alongside some technical commentary I worked really hard on that allows you to read and write financial data. It's sad to see that equally significant portion of my work dismissed as 'alright findings'.

orf 9y ago
Don't feel diminished by comments like that. From a technical point of view the issues are great, but I think the parent comment was referring to the overall 'jist' of the issues - no SQL injection, RCE or other 'stupid' findings that indicate serious underlying problems with the site. The issues are 'alright', which lies between 'silly' (banner disclosure) and 'everything is fucked' (db access) Also, more generally, don't take internet comments personally. You know how much effort you put in, and your writing reflects that. You're on BBC news for god's sake, congratulations. Also 2, amazing writeup. I love your style, it rings a bell. #ezbake ?
- zemnmez 9y ago
  thank you. I may have reacted excessively. I'm glad you enjoyed it :)
morrbo 9y ago
Pretty much exactly what Orf said below. The writeup was great and you did a fantastic job of knowledge sharing (which is what this is all about tbh). However the "alright" refers to the two aforementioned medium risk issues. When i saw "serious vulnerabilities" on a BBC news site, i figured - especially with the open sourcing of payg/gov code, the recent struts vulnerability, etc. etc. - there was going to be something really major, and felt a bit clickbaited. Don't take it personally, as it was never aimed at being personal.
- zemnmez 9y ago
  yeah, I'm sorry there ... I thought this was pointed directly at my article. I agree on the scale of things that could have potentially happened that these things are in middle of the scale. But I do respectfully disagree that they can't be referred to as serious. It may be an XSS -- not critical in traditional bug taxonomies, and perhaps in an alternate future I could have dumped the whole DB but it is also an xss in a tax system. Again, sorry for perhaps over-reacting there.

orf 9y ago

Don't feel diminished by comments like that. From a technical point of view the issues are great, but I think the parent comment was referring to the overall 'jist' of the issues - no SQL injection, RCE or other 'stupid' findings that indicate serious underlying problems with the site. The issues are 'alright', which lies between 'silly' (banner disclosure) and 'everything is fucked' (db access) Also, more generally, don't take internet comments personally. You know how much effort you put in, and your writing reflects that. You're on BBC news for god's sake, congratulations. Also 2, amazing writeup. I love your style, it rings a bell. #ezbake ?

zemnmez 9y ago
thank you. I may have reacted excessively. I'm glad you enjoyed it :)

morrbo 9y ago

Pretty much exactly what Orf said below. The writeup was great and you did a fantastic job of knowledge sharing (which is what this is all about tbh). However the "alright" refers to the two aforementioned medium risk issues. When i saw "serious vulnerabilities" on a BBC news site, i figured - especially with the open sourcing of payg/gov code, the recent struts vulnerability, etc. etc. - there was going to be something really major, and felt a bit clickbaited. Don't take it personally, as it was never aimed at being personal.

zemnmez 9y ago
yeah, I'm sorry there ... I thought this was pointed directly at my article. I agree on the scale of things that could have potentially happened that these things are in middle of the scale. But I do respectfully disagree that they can't be referred to as serious. It may be an XSS -- not critical in traditional bug taxonomies, and perhaps in an alternate future I could have dumped the whole DB but it is also an xss in a tax system. Again, sorry for perhaps over-reacting there.