5 ms·

It's sad when site owners don't respect reports of security bugs. Maybe they don't care, or their trust was lost by being hacked previously... Either way the u

by gitgud 8y ago

It's sad when site owners don't respect reports of security bugs. Maybe they don't care, or their trust was lost by being hacked previously... Either way the user's suffer...

edent 8y ago
Yup. I'm used to silence. Or perhaps a disgruntled acknowledgement. But that's the first time I've ever received abuse because of it.
- shshhdhs 8y ago
  I’m seriously amazed at how abusive Howard is. I went back to your other post [1] and read his replies, and can’t believe how consistent his attitude is. He seems unreasonable. It was nice to see your patient, level-headed reply. [1] https://shkspr.mobi/blog/2018/06/how-i-became-leonardo-da-vinci-on-the-blockchain/ https://shkspr.mobi/blog/2018/06/how-i-became-leonardo-da-vi...
  - pavel_lishin 8y ago
    > But so what? Is that the problem in the art world? That rich people are criminals? Really? Yikes.
  - laumars 8y ago
    He's probably just a kid playing around with some cool technology and kicking off because he's young and over-confident (I'm sure many of us can relate to that - even if we weren't so foul mouthed). One of the great things about the web is it evens the playing field for anyone to build tech. The cost of that is it becomes harder to spot someone with experience from someone who isn't. In any case, I think you handled the situation far better than most would have.
    - deleted 8y ago
      [deleted]
lvh 8y ago
This is one reason 'tptacek any I are so militant on the "responsible disclosure" issue. People who seem to believe the onus is on security researchers to do whatever song and dance the person who are actually responsible want. That's nonsense: if you find the bug you get to do whatever you want with that information. (Including, I think, trade on it? But I'm not a lawyer and that's not legal advice.)
- pavel_lishin 8y ago
  > the onus is on security researchers to do whatever song and dance the person who are actually responsible want It's not about bending to the will of an incompetent idiot; it's about protecting vulnerable end users from the idiot in question.
  - lvh 8y ago
    Well, it's subtle, right? That presupposes they're an incompetent idiot, and if they are, I agree: you should just publish a full disclosure. A lot of projects/companies fortunately are not staffed by incompetent idiots. I'm also not saying "never disclose to the company/project". It's what I do 100% of the time if it's worth disclosing and I don't have prior evidence that they'll react poorly. I'm saying researchers have no moral obligation to do anything.
    - pavel_lishin 8y ago
      > I'm saying researchers have no moral obligation to do anything. I don't think I agree with you, but I understand your point of view, and don't think I can really argue from any sort of objective reasoning.
      - lvh 8y ago
        Well, I'm happy to walk you through it if you're game. Let's say the company is an incompetent idiot: that also means they're unlikely to respond well to a well-written vuln report. So what protects the general public the most? The bad guys can find vulns too, and you have no idea if you're the first to find a vulnerability, and we're presupposing the company won't handle it well. The _best outcome_ for the general public is full, immediate, public disclosure in that case! There are other arguments here, like the fact that random people putting bugs in websites are not entitled to a researcher's time.

by gitgud 8y ago

It's sad when site owners don't respect reports of security bugs. Maybe they don't care, or their trust was lost by being hacked previously... Either way the user's suffer...

edent 8y ago

Yup. I'm used to silence. Or perhaps a disgruntled acknowledgement. But that's the first time I've ever received abuse because of it.

shshhdhs 8y ago
I’m seriously amazed at how abusive Howard is. I went back to your other post [1] and read his replies, and can’t believe how consistent his attitude is. He seems unreasonable. It was nice to see your patient, level-headed reply. [1] https://shkspr.mobi/blog/2018/06/how-i-became-leonardo-da-vinci-on-the-blockchain/ https://shkspr.mobi/blog/2018/06/how-i-became-leonardo-da-vi...
- pavel_lishin 8y ago
  > But so what? Is that the problem in the art world? That rich people are criminals? Really? Yikes.
- laumars 8y ago
  He's probably just a kid playing around with some cool technology and kicking off because he's young and over-confident (I'm sure many of us can relate to that - even if we weren't so foul mouthed). One of the great things about the web is it evens the playing field for anyone to build tech. The cost of that is it becomes harder to spot someone with experience from someone who isn't. In any case, I think you handled the situation far better than most would have.
  - deleted 8y ago
    [deleted]

lvh 8y ago

This is one reason 'tptacek any I are so militant on the "responsible disclosure" issue. People who seem to believe the onus is on security researchers to do whatever song and dance the person who are actually responsible want. That's nonsense: if you find the bug you get to do whatever you want with that information. (Including, I think, trade on it? But I'm not a lawyer and that's not legal advice.)

pavel_lishin 8y ago
> the onus is on security researchers to do whatever song and dance the person who are actually responsible want It's not about bending to the will of an incompetent idiot; it's about protecting vulnerable end users from the idiot in question.
- lvh 8y ago
  Well, it's subtle, right? That presupposes they're an incompetent idiot, and if they are, I agree: you should just publish a full disclosure. A lot of projects/companies fortunately are not staffed by incompetent idiots. I'm also not saying "never disclose to the company/project". It's what I do 100% of the time if it's worth disclosing and I don't have prior evidence that they'll react poorly. I'm saying researchers have no moral obligation to do anything.
  - pavel_lishin 8y ago
    > I'm saying researchers have no moral obligation to do anything. I don't think I agree with you, but I understand your point of view, and don't think I can really argue from any sort of objective reasoning.
    - lvh 8y ago
      Well, I'm happy to walk you through it if you're game. Let's say the company is an incompetent idiot: that also means they're unlikely to respond well to a well-written vuln report. So what protects the general public the most? The bad guys can find vulns too, and you have no idea if you're the first to find a vulnerability, and we're presupposing the company won't handle it well. The _best outcome_ for the general public is full, immediate, public disclosure in that case! There are other arguments here, like the fact that random people putting bugs in websites are not entitled to a researcher's time.