3 ms·
When vendors are that annoying I usually just go full disclosure. I found some privilege escalations on some small cloud providers though that went as far as i
by lawl 8y ago
When vendors are that annoying I usually just go full disclosure.
I found some privilege escalations on some small cloud providers though that went as far as ignoring my mails to their listed security@.... e-mail, or yeah, not having a contact listed at all.
Not quite sure what to do with those. Posting these to a full-disclosure list? They're too small nobody's going to care, until someone does and steals customer data. Might as well just ignore it until someone else discovers it and steals customer data?
- benchaney 8y agoI’m strongly in the full disclosure in that situation camp. At the very least, if you fully disclose the vulnerability and the company ignores it, it serves as a warning to their customers about what they are at risk of.
- eat_veggies 8y agoHackerOne provides disclosure assistance [0] for uncooperative companies. Not sure how they handle it from there. [0] https://hackerone.com/disclosure-assistance https://hackerone.com/disclosure-assistance
- greggman 8y agoHackerone and some issues with it are brought up in the article.