3 ms·
How does this SHA-1 hash come full circle? Everybody on the web will know that I hashed something. The vender knows that I hashed the findings I sent to them, b
by euroclydon 16y ago
How does this SHA-1 hash come full circle? Everybody on the web will know that I hashed something. The vender knows that I hashed the findings I sent to them, but so what? Do I have to post the hash on my own domain, so the vender knows that the findings they received are from the same person who owns the domain where the hash was posted?
I don't see what this hash achieves.
- tptacek 16y agoHash + reputation = documented finding. Note that the hash isn't my idea. People have been doing it for years.
- euroclydon 16y agoIf I could have understood with that much additional information, I wouldn't have asked in the first place.
- atamyrat 16y agoI think point of hashing is to prove that researcher has indeed found the vulnerability first and reported it to the vendor. It is proof for "this summary was written by me 2 months ago". Hash must be posted to some archived/public place (tweet, mailing list, etc) that can be referenced at later date when actual summary is released.
- khafra 16y agoSubtracting "reputation" as a requirement in that equation has to have at least a small positive value, doesn't it? I don't know how many independent researchers there are who have a chicken-and-egg problem with reputation because they don't know how to disclose both visibly and responsibly. But if there are any, Zed's method seems beneficial.