4 ms·
One aspect that is not reflected in this format is that the site/company might have a specific routine for reporting vulns. When I happened to write to Node (ii
by aasasd 6y ago
One aspect that is not reflected in this format is that the site/company might have a specific routine for reporting vulns. When I happened to write to Node (iirc) about some potential problem, the mail was just redirected to HackerOne, converted to some kind of a draft, and I got an automatic response saying I need to create an account there. In true marginal-nerd fashion, I have some opinions on which of my email addresses go where, so the account remains uncreated and the problem unreported by me. And Node didn't specify anywhere that this reporting works through HackerOne.
(I also realize that this comment is probably not the right place to complain about the format, but eh.)
- aaronmdjones 6y agoThis is what the Policy: key in the format is for.
- aasasd 6y agoYou're right, that would work. Though the UX designer in me thinks that if the policy is important, it would be better to put in up on a webpage and slap that into the ‘contact’ field—as a neighbor comment suggests. At least when the whole process turns out to sidestep email completely.
- Y_Y 6y agoI'd have responded the same way. I'm not creating an account just to do someone else a favour. I will send an email and that's it. If you don't have an email address then you're not getting a message from me. It's disappointing how frequently this comes up.
- yarcob 6y agoYeah, worst part is when some support engineer asks you to please post the bug to a bug tracker, but the bug tracker requires an account, and when you try to sign up they make you wait for someone to review your account, and at some point you wonder if these people ever get a single bug report from a customer.
- sedatk 6y agoYou can put a URL on the contact field.
- aasasd 6y agoAh! Indeed, I missed that alternative.