4 ms·

I am surprised that people still report bugs when there isn't an official bug bounty/bug reporting program in place that explicitly promises to avoid legal acti

I am surprised that people still report bugs when there isn't an official bug bounty/bug reporting program in place that explicitly promises to avoid legal action against anyone who reports while following the rules of the program. When there's no such program in place you either move on or do your best to disclose as publicly and anonymously as possible (tip to journalists or, worst case, open a new twitter account while behind 7 proxies).

bllguo 9y ago
the OP is likely not a security professional. Is it really surprising that he/she did not expect this result?
- gerdesj 9y ago
  "the OP is likely not a security professional" What exactly is a security professional? I'm CREST accredited - do I count? Perhaps. I'm quite handy in the ways of IT (been doing it for 25+ years) That does not have the same cachet as my Civil Engineering quali. that is accredited but not time served. I would probably still be trusted to design a (very small!) bridge or dam or road section. I can survey proficiently etc. In short I could probably still design stuff that people would be willing to put their lives on the line with. What gives people the sense that a pro. is in charge of something in IT? IT buggered it up early on with "industry" qualis. MS with their MSCEs and all the other worthless crap. We lurch from snag to snag. It is bloody ridiculous. We need Engineers with a capital E to stand up and get a fucking grip.
gerdesj 9y ago
"I am surprised that people still report bugs when there isn't an official bug bounty/bug reporting program" IT is still young as a discipline. This is an emerging example of "industry practice".