3 ms·
Oh I remember this. Dumbass had no idea what kind of issue he had on his hands and just blew it off not realizing the level of blowback and publicity that would
by Salgat 8y ago
Oh I remember this. Dumbass had no idea what kind of issue he had on his hands and just blew it off not realizing the level of blowback and publicity that would occur if the whitehat decided to publicly announce it. Boggles the mind how these people get such high paying jobs.
- duxup 8y agoIt is so confusing as the pattern of: 1. Dude contacts you. 2. You fail to work with him / or just don't. 3. It becomes public and you look like idiots. That pattern is so established that every security executive should know you want to avoid that... but nope, some run headlong into it. I'm no security dude at all, and I can recognize that pattern just from reading the news. What on earth is an executive reading if they have no idea?
- Kalium 8y agoA fair number of people wind up in executive security roles with no technical background to speak of. That said, for every legitimate security researcher, there are dozens of people who are blowhards. Bug bounty programs, for example, are stuffed full of "[CRITICAL][ACCOUNT TAKEOVER] EMERGENCY VULNERABILITY"... which is actually some skiddie reporting someone being able to XSS themselves. On the outside, you mostly just see the ones that go bad. On the inside, any given report is unlikely to be nearly as severe as it's claimed to be.
- duxup 8y agoOh I hear ya. The lack of knowledge extends to the "researchers" for sure. The unfortunate thing about the Panara Bread deal was any dude could have just pulled up Postman and hit the API and seen the results / issue in a couple seconds + however long it takes Postman to start on their computer. They didn't even try, they could have rule out "crazy researcher" in seconds.