5 ms·
I like how people that write these types of stories always justify it as trying to help out... "In the hope that digg would now listen, I sent them a second ema
by ejs 18y ago
I like how people that write these types of stories always justify it as trying to help out... "In the hope that digg would now listen, I sent them a second email."
So digg was supposed to jump on this problem and not worry about anything else apparently.
It always seemed akin to saying
"I saw an unlocked vehicle today and I think its important that all vehicles remain locked. Since they didn't come running out when I told them to lock the car, I put it in neutral and let it roll down a hill so that they will now heed the warning"
While warning about possible vulnerabilities is helpful I have a hard time believing exploiting them is as well.
- StStartup 18y agoYour example does make sense, but in the case of Digg, its not a car, but a careless air carrier.
- deathbyzen 18y agoIt does seem like a juvenile mentality, but seriously, fuck digg.
- j2d2 18y agoThe full-disclosure community used to believe in this philosophy but for different reasons. They were trying to disclose the bug as a form of motivation with little regard to what else the company was working on. I suspect this message is not well understood now and the notion of full-disclosure being good is all that's left.
- jobeirne 18y agoA better analogy would be "I saw an unlocked vehicle today and I think its important that all vehicles remain locked. Since they didn't come running out when I told them to lock the car, I opened the car and left a note on the dashboard stating I'd been in the car."
- DEinspanjer 18y agoI disagree. I think the better analogy woudl be: "I saw an unlocked vehicle today and I think its important that all vehicles remain locked. Since they didn't come running out when I told them to lock the car, I [opened] the car and left a note on the dashboard stating I'd been in the car." "And then I went into the bad part of town and distributed fliers all around about how the car at the corner of Main and Screwed had been left unlocked for a while and how it had a great stereo and iPod in it."
- jobeirne 18y agoStill a bit off. "[going] into the bad part of town" would imply he went on some devious message board and there released the information with a flashy heading.
- sah 18y agoAn unlocked car only leaves the owner vulnerable to break-ins. This is more like noticing that Honda Civics can't be properly locked, and leaving a note on the dashboard of each and every one, so that Honda will experience pressure to fix the problem.
- simonw 18y ago"So digg was supposed to jump on this problem and not worry about anything else apparently." Quite frankly, yes they should. If you have an XSS hole in your web application your other user-facing security measures are worthless. If you're a social application of any sort it's even worse; you're just asking to be hit by a worm. XSS is a Big Deal. XSS holes also really easy to find, so if a security researcher spots one it's not unlikely that a Bad Guy will find them as well.
- bocajuniors 18y agoa better analogy would be: your car may be locked but other people have keys that unlocks your car.then someone proves it by unlocking the car with his key
- babul 18y agolol, liking your analogy :)
- Tichy 18y agoReminds me of one of my all-time favorite cartoons: "Too Much Coffee Man, Doing Your Part" http://tmcm.com/comics/webcomics/092_yourpart http://tmcm.com/comics/webcomics/092_yourpart