4 ms·

How long does it take you to find the security contact for the coreboot project (www.coreboot.org)? I guess it's on the order of seconds. And yet we had some i

How long does it take you to find the security contact for the coreboot project (www.coreboot.org)? I guess it's on the order of seconds. And yet we had some interaction on the main mailing list with a journalist covering security fluff (there wasn't much substance) just recently claiming that they "didn't find the contact address" (see https://mail.coreboot.org/hyperkitty/list/coreboot@coreboot.org/message/PD2QTLR5DJDEEELBGWKC6RLMET5SME3D/ https://mail.coreboot.org/hyperkitty/list/coreboot@coreboot....) So yes, one could say that the journalist should have been more diligent in their search and yet, security is one of the issues where I'd rather hear about things too often than miss something. If that standard gains traction, I'd expect even a half-competent person in the field to know to look for the two URL patterns (or to use a tool that does it for them) which eliminates the question of "were we clear enough on how to reach out?"

pvg 7y ago
"chance of someone occasionally being less wrong on the internet" for "certainty of steady stream of bogus reports" seems like a pretty bad trade off, let alone one that requires a special standard to achieve.
- tptacek 7y ago
  What's really rough about the steady stream of bogus reports is that they're injecting noise into a channel you really need to read, because amidst all the garbage CAA and Clickjacking and cookie handling and CSP header and Firefox 2.x open redirect nonsense are occasional serious reports of things like XSS, and the important reports aren't any better written than the bad reports so you have to read everything kind of carefully. My experience has been that you get the decent reports regardless of whether you even have a /security URL, but if you open a formal bounty program you instantly and permanently ratchet up the noise, because this is a way for people in lower-income countries to make money in their bedrooms with a laptop and without much thought. You shitcan the bullshit CAA record reports, but other companies without people who are good at triage on staff don't; they'll shell out a couple bucks for them, even though they're garbage.
  - deleted 7y ago
    [deleted]

pvg 7y ago

"chance of someone occasionally being less wrong on the internet" for "certainty of steady stream of bogus reports" seems like a pretty bad trade off, let alone one that requires a special standard to achieve.

tptacek 7y ago
What's really rough about the steady stream of bogus reports is that they're injecting noise into a channel you really need to read, because amidst all the garbage CAA and Clickjacking and cookie handling and CSP header and Firefox 2.x open redirect nonsense are occasional serious reports of things like XSS, and the important reports aren't any better written than the bad reports so you have to read everything kind of carefully. My experience has been that you get the decent reports regardless of whether you even have a /security URL, but if you open a formal bounty program you instantly and permanently ratchet up the noise, because this is a way for people in lower-income countries to make money in their bedrooms with a laptop and without much thought. You shitcan the bullshit CAA record reports, but other companies without people who are good at triage on staff don't; they'll shell out a couple bucks for them, even though they're garbage.
- deleted 7y ago
  [deleted]