4 ms·
Publish it on the internet. Keeping it to yourself and the company is security by obscurity which the security community frowns on.
by sys_64738 7y ago
Publish it on the internet. Keeping it to yourself and the company is security by obscurity which the security community frowns on.
- mannykannot 7y ago'Security by obscurity' is deprecated because obscurity alone does not lead to security. This in no way promotes, endorses or justifies irresponsible disclosure.
- thenewnewguy 7y ago"Responsible disclosure" is a buzzword made up by companies to bully security researchers into keeping quiet about vulnerabilities for months. If the OP is unable to contact the maintainer because they are missing it would be irresponsible to keep quiet about the bug.
- mannykannot 7y agoResponsible disclosure is a valid concept that some companies attempt to abuse. In the scenario you propose here, I would probably contact CMU's CERT division.
- sys_64738 7y agoNon-disclosure continues to allow security issues to slide by. Companies need to know security is their absolute #1 priority to the extent that it will damage the business every time one of these issues is exposed. Today they have no incentive to fix issues and prevent future ones as the exposure is minimized.
- cpach 7y agoPublishing can be reasonable but it seems like OP wanted to contact the author first, which is a good idea IMHO.