3 ms·
I can’t help but feel that posting this in a HN comment when they’re showing off the site isn’t exactly responsible disclosure.
by procinct 8y ago
I can’t help but feel that posting this in a HN comment when they’re showing off the site isn’t exactly responsible disclosure.
- dna_polymerase 8y agoWhoever runs a service that allows running untrusted code in 2018 deserves no responsible disclosure but a punch in the face. It doesn't help if we allow those entities to exist.
- procinct 8y agoChances are, they are a beginner. This is someone’s side project not a site backed by a huge corporation. They deserve responsible disclosure so they can learn from it.
- moftz 8y agoIts just a fork of codewars Try typing this before every function (python): class Test: def assert_equals(*args): return True
- SlowRobotAhead 8y agoOn the flip side, if such an embarrassing exploit is found in the first hour, maybe it’s the equivalent to making the student read their note out to the entire class as punishment?
- dang 8y agoPlease don't be a jerk on HN. Edit: it looks like you've done it repeatedly; https://news.ycombinator.com/item?id=18381061 https://news.ycombinator.com/item?id=18381061 was actually a bannable offense. Commenters here need to do better than this, so please view https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and follow the rules from now on.
- hartator 8y agoResponsible disclosure is meant when it can jeopardize user data or user devices. It’s reasonable to assume none of that apply for a brand new service. Specially now everyone is learning from it.
- dqpb 8y agoI disagree. I see HN as a community of people involved in similar pursuits, and demonstrating issues like this publicly is educational for everyone.
- DavideNL 8y agoSure, but you can "demonstrate" the details after it's fixed.
- SlowRobotAhead 8y agoSeems like a lot of damage could have been obviously omitted by just removing anything os.system(), which for the purpose (not effect here) of Duolingo style education should have been just fine. I get your point and the other guy’s too. I line up on the side that disclosures should be messy and embarrassing sometimes, as incentive to really think about what you are doing. The danger here is low.