3 ms·
This isn't very interesting, at least no more interesting than any other disclosure that goes through H1. If you're not familiar with disclosures and communica
by staticassertion 7y ago
This isn't very interesting, at least no more interesting than any other disclosure that goes through H1.
If you're not familiar with disclosures and communication via H1 maybe this all feels very odd or bad or something, idk. Looks fairly standard to me.
Ultimately, to me, someone found a vulnerability, reported the vuln, and it was remediated within ~3 hours. There was no "breach", unless you consider every H1 report a breach?
Having a repository of vulns is quite a scary thing though. I often wonder, with all of the "wontfix" and "too low impact to care" bugs chained together, how easy is it to own many of these customers?
- eterm 7y agoIt used to be that wontfix / low impact stuff would still be publically disclosed. Responsible disclosure was the key principle. There shouldn't be a gap between "won't fix" and "Too bad to be made public". If a company is happy not to fix something, they shouldn't complain if it's published.