3 ms·

Please consider disclosing the issue responsibly by releasing it to the public. Keeping it secret and only telling a select few gives the ability to the said fe

Please consider disclosing the issue responsibly by releasing it to the public. Keeping it secret and only telling a select few gives the ability to the said few (which may include Telegram itself) to use the vulnerability maliciously. In addition even if you have disclosed the issue to the Telegram team and Telegram has fixed said vulnerability the same may not be said for any forks of it whose maintainers are not aware of the issue.

DyslexicAtheist 8y ago
> and only telling a select few gives the ability If more than 1 person knows something it's no longer a secret. Likewise if 2 people know about the existence of a 0day it's no longer a 0day. ... Why should I burn a 0day? Who will pay me for it? I'm not stupid and I don't participate in the responsible disclosure circle jerk. TG is snakeoil: If you use it for anything more serious than hiding an affair from your spouse high chance you get burnt. Especially wanna be terrorists ought to stay clear. TG is one giant weird machine: You'll notice quickly if you play with it. There very likely many 0days in TG and for sure LE has access to it too. So finding something isn't even a statistical outlier. People who think that responsible disclosure must be practiced are just parroting the corporate bullshit. Bug bounties hunters are the Uber drivers of InfoSec. Poor fuckers that are pressed into a system that only benefits the corporate overlords. How about starting with responsible QA instead of moving fast & breaking things?
- dijit 8y ago
  Sorry to call you out, we should always assume good faith from HN commenters but I must say that this is childish behaviour. Either it's pertinent information to be entered into the public record as part of your comment, or it's not. If it's pertinent information you don't get to say "trust me", you have the responsibility to provide information. If you cannot do that, then do not say it. You will not convince me with mealy mouthed weasel words. -- On a more personal note: this comment sounds like the kind of thing I would see on skiddie hacker forums 15 years ago. Please conduct yourself better.
  - DyslexicAtheist 8y ago
    Engage much in SJW'ism Jane? Enjoy telling others what to do? Seriously, you are free to ignore what I say here. My comments aren't meant as statements for future generations. I'm not that important and you shouldn't take yourself as that important either. I couldn't care less what people think is my responsibility. It's my view and I don't give a fuck if it's a shared view or not. In fact in these days if society shares my view readily high chances I'm probably doing something wrong. Please speak for yourself Jane, and don't impress your small minded personal world view on others.
    - dijit 8y ago
      My goodness. You’re so intimidating. Perhaps you should go back to school instead of impressing upon other for how cool you are “doxxing” them. FWIW you didn’t dig deep enough. I am not a Jane.
      - DyslexicAtheist 8y ago
        sorry you feel this way. it's hardly doxxing though if you have your name in your profile is it? you're the one using veiled insults and calling me a mealy weasel mouth. And using language like "sorry for calling you out" ... Don't say "sorry" and then launch your veiled attack in the same paragraph. > Perhaps you should go back to school is that where you got your world view from?
- AnaniasAnanas 8y ago
  > People who think that responsible disclosure must be practiced are just parroting the corporate bullshit I did not use "responsible disclosure" as commonly defined (apologies for any confusion), simply because I do not think that telling only the creator of the program is responsible - instead I asked you to try and consider disclosing the issue responsibly by making it public to everyone (rather than just Telegram). I consider a disclosure responsible only if both the users and any developers (including these of any forks) are aware of the issue at the same time. I do not think that the way that I personally used the term "responsible" is in any way "corporate bullshit", after all the corporations tend to ask to be the only ones (or the first ones) to learn about the issue.
- gsich 8y ago
  So you don't have a 0day. Normally people don't brag about it, because it only lures attention. And now by your own definition, many people know about the (potential?) 0day, even without details.

DyslexicAtheist 8y ago

> and only telling a select few gives the ability If more than 1 person knows something it's no longer a secret. Likewise if 2 people know about the existence of a 0day it's no longer a 0day. ... Why should I burn a 0day? Who will pay me for it? I'm not stupid and I don't participate in the responsible disclosure circle jerk. TG is snakeoil: If you use it for anything more serious than hiding an affair from your spouse high chance you get burnt. Especially wanna be terrorists ought to stay clear. TG is one giant weird machine: You'll notice quickly if you play with it. There very likely many 0days in TG and for sure LE has access to it too. So finding something isn't even a statistical outlier. People who think that responsible disclosure must be practiced are just parroting the corporate bullshit. Bug bounties hunters are the Uber drivers of InfoSec. Poor fuckers that are pressed into a system that only benefits the corporate overlords. How about starting with responsible QA instead of moving fast & breaking things?

dijit 8y ago
Sorry to call you out, we should always assume good faith from HN commenters but I must say that this is childish behaviour. Either it's pertinent information to be entered into the public record as part of your comment, or it's not. If it's pertinent information you don't get to say "trust me", you have the responsibility to provide information. If you cannot do that, then do not say it. You will not convince me with mealy mouthed weasel words. -- On a more personal note: this comment sounds like the kind of thing I would see on skiddie hacker forums 15 years ago. Please conduct yourself better.
- DyslexicAtheist 8y ago
  Engage much in SJW'ism Jane? Enjoy telling others what to do? Seriously, you are free to ignore what I say here. My comments aren't meant as statements for future generations. I'm not that important and you shouldn't take yourself as that important either. I couldn't care less what people think is my responsibility. It's my view and I don't give a fuck if it's a shared view or not. In fact in these days if society shares my view readily high chances I'm probably doing something wrong. Please speak for yourself Jane, and don't impress your small minded personal world view on others.
  - dijit 8y ago
    My goodness. You’re so intimidating. Perhaps you should go back to school instead of impressing upon other for how cool you are “doxxing” them. FWIW you didn’t dig deep enough. I am not a Jane.
    - DyslexicAtheist 8y ago
      sorry you feel this way. it's hardly doxxing though if you have your name in your profile is it? you're the one using veiled insults and calling me a mealy weasel mouth. And using language like "sorry for calling you out" ... Don't say "sorry" and then launch your veiled attack in the same paragraph. > Perhaps you should go back to school is that where you got your world view from?
AnaniasAnanas 8y ago
> People who think that responsible disclosure must be practiced are just parroting the corporate bullshit I did not use "responsible disclosure" as commonly defined (apologies for any confusion), simply because I do not think that telling only the creator of the program is responsible - instead I asked you to try and consider disclosing the issue responsibly by making it public to everyone (rather than just Telegram). I consider a disclosure responsible only if both the users and any developers (including these of any forks) are aware of the issue at the same time. I do not think that the way that I personally used the term "responsible" is in any way "corporate bullshit", after all the corporations tend to ask to be the only ones (or the first ones) to learn about the issue.
gsich 8y ago
So you don't have a 0day. Normally people don't brag about it, because it only lures attention. And now by your own definition, many people know about the (potential?) 0day, even without details.