4 ms·

I imagine that publicizing a web vulnerability hotline would result in more trouble that it would solve. Normal people really don't understand computers. If you

I imagine that publicizing a web vulnerability hotline would result in more trouble that it would solve. Normal people really don't understand computers. If you somehow give off the message that your system is not perfectly secure or bug-free they would get scared and run off to competitors who are just as bug-ridden but at least appear to be more secure.

mgkimsal 15y ago
While I sort of see, marketing/wording of this could spin this as a positive (assuming it was even something that was publicized - perhaps hidden in the markup is good enough?). We've popularized crime reporting as a social good - mcgruff the crime dog, etc. When will we start taking online safety and security with the same level of seriousness? As much as I don't like the idea, being able to report issues to a state or federal agency might be a way to go.
jrwoodruff 15y ago
Normal phone techs should know how to deal with such calls (even if they don't understand the exact problem) and have a line/department to forward the call too. That provides filtering for legit claims, and avoids advertising it and scaring people. Simple.
cosgroveb 15y ago
Eh I dunno. Google does this with its Vulnerability Reward Program [1] and people seem to be fine with sharing almost all of their private data with Google from all their e-mails to their credit card numbers (Google checkout), etc., etc. Also Facebook has a form for reporting vulns [2] and people are still happy to share their personal info there. I'm sure there are other companies that have "hotlines" but these are just a few I can think of. I don't think having an avenue for responsible security bug disclosure gives anyone the impression that their data is unsafe. [1] http://googleonlinesecurity.blogspot.com/2010/11/rewarding-web-application-security.html http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w... [2] https://www.facebook.com/help/contact.php?show_form=white_hat https://www.facebook.com/help/contact.php?show_form=white_ha...
- daeken 15y ago
  Mozilla and CCBill as well: http://www.mozilla.org/security/bug-bounty.html http://www.mozilla.org/security/bug-bounty.html http://www.ccbill.com/developers/security/vulnerability-reward-program.php http://www.ccbill.com/developers/security/vulnerability-rewa...
- nitrogen 15y ago
  Aren't you acknowledging violation of the Facebook TOS by submitting that form?
jasongullickson 15y ago
I don't disagree with you, but this reminds me of the anti-seatbelt arguments from automakers before the law required them.

mgkimsal 15y ago

While I sort of see, marketing/wording of this could spin this as a positive (assuming it was even something that was publicized - perhaps hidden in the markup is good enough?). We've popularized crime reporting as a social good - mcgruff the crime dog, etc. When will we start taking online safety and security with the same level of seriousness? As much as I don't like the idea, being able to report issues to a state or federal agency might be a way to go.

jrwoodruff 15y ago

Normal phone techs should know how to deal with such calls (even if they don't understand the exact problem) and have a line/department to forward the call too. That provides filtering for legit claims, and avoids advertising it and scaring people. Simple.

cosgroveb 15y ago

Eh I dunno. Google does this with its Vulnerability Reward Program [1] and people seem to be fine with sharing almost all of their private data with Google from all their e-mails to their credit card numbers (Google checkout), etc., etc. Also Facebook has a form for reporting vulns [2] and people are still happy to share their personal info there. I'm sure there are other companies that have "hotlines" but these are just a few I can think of. I don't think having an avenue for responsible security bug disclosure gives anyone the impression that their data is unsafe. [1] http://googleonlinesecurity.blogspot.com/2010/11/rewarding-web-application-security.html http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w... [2] https://www.facebook.com/help/contact.php?show_form=white_hat https://www.facebook.com/help/contact.php?show_form=white_ha...

daeken 15y ago
Mozilla and CCBill as well: http://www.mozilla.org/security/bug-bounty.html http://www.mozilla.org/security/bug-bounty.html http://www.ccbill.com/developers/security/vulnerability-reward-program.php http://www.ccbill.com/developers/security/vulnerability-rewa...
nitrogen 15y ago
Aren't you acknowledging violation of the Facebook TOS by submitting that form?

jasongullickson 15y ago

I don't disagree with you, but this reminds me of the anti-seatbelt arguments from automakers before the law required them.