7 ms·
> Actually, I don't need any permission whatsoever to publish a vulnerability I find in your site, nor is there any real norm in the infosec community that I sh
by rtpg 9y ago
> Actually, I don't need any permission whatsoever to publish a vulnerability I find in your site, nor is there any real norm in the infosec community that I shouldn't
Is there really no norm to at least try and contact the affected service before publishing an exploit? Seems like basic courteousy, though I understand some people are not super receptive.
- CiPHPerCoder 9y ago> Seems like basic courteousy Read https://adamcaudill.com/2015/11/19/responsible-disclosure-is-wrong/ https://adamcaudill.com/2015/11/19/responsible-disclosure-is...
- rtpg 9y agoYeah that post makes a lot of sense. It seems like this would establish a norm of generally trying to coordinate with a vendor in many circumstances (if a web service is vulnerable hard for users to fix it themselves after all). Might of misread what "norm" meant here