3 ms·
I'm not a security expert. I am a software engineer; as such make it my responsibility to understand something of network security, but I have no formal trainin
by lucideer 7y ago
I'm not a security expert. I am a software engineer; as such make it my responsibility to understand something of network security, but I have no formal training in such and I don't work in a specifically security-focused role. Nor do I work for an explicitly security-focused company.
I understood the issue clearly on first read.
You're absolutely right that it could have been explained more clearly, and that there is some ambiguity in the wording (not everyone's a perfect communicator). But if I (a very normal, non-security-focused software engineer) can grok this, it's the absolute least I would expect from someone working for HackerOne! Their entire job is to be able to understand this sort of thing in depth.
- oehpr 7y agoExactly! I was sitting there scratching my head on this one. I get that Joe Shmoe wouldn't understand the risks of a MITM and the potential areas it could be exploited, even John Q Programmer I wouldn't guarantee to understand the risks. But a person working at Hacker One who's job is assessing vulnerabilities doesn't understand the threat of a MITM? What?! Does everyone at Hacker One think the whole move to HTTPS was just pointless security theater or something? How is that possible? How does this chain of events even happen? It looks like the author spoke to multiple people at Hacker One who were genuinely not understanding the threat, after it was explained to them. We must be missing some side of this here. That's too absurd to be real.
- flatiron 7y agoI skimmed it. He saw a bunch of http gets and the setup a dns server and ohh I see where he’s going with this. Yep a picture of a weird page in the steam app ok I get it.