3 ms·
> Unfortunately, this is, in fact, the second time I have discovered this exact vulnerability. The first time, the issue was reported and fixed, but after findi
by neiman 5y ago
> Unfortunately, this is, in fact, the second time I have discovered this exact vulnerability. The first time, the issue was reported and fixed, but after finding it again, I can see that simply reporting the issue was a mistake.
I feel uncomfortable with this. The author already reported a vulnerability, it was fixed, but now there's a new one (which is identical, ok, but new nevertheless), so he decided they didn't study their lesson, and punish them with public shaming? I'd maybe get it if the first time was ignored, but like this? Nah ah.
It's like my worse teachers coming back to hunt me as an adult.
- mdoms 5y agoIt's absolutely appropriate.
- neiman 5y agoWhy?
- argvargc 5y agoIsn't it a bit more like a school suspending someone for turning up to class with explosives in their bag, and after they explain and apologise the school let's them off with a suspension, and then a short time later when the suspension is done they go ahead and do it again and this time the school just goes straight to the cops?
- mod 5y agoNo, because it's not normal to accidentally or unknowingly bring explosives to school. It IS normal to accidentally or unknowingly have a flaw in software. So normal that it's likely every piece of software on the planet has flaws, many of which allow the exfiltration of data.
- neiman 5y agoNo, mistakes are unintentional, bringing explosives to school is. You can, on the other hand, claim it's irresponsible, but there are many devs here who can testify that mistakes do happen and do recur in software projects. You need more evidence than "the same mistake happened twice" to imply irresponsibility.
- argvargc 5y agoThere is a point where the potential consequences of a software flaw are so great that failing to fix it properly - after being informed of it - can understandably be seen as negligence.
- neiman 5y agoAs far as I understood they fixed the first bug. This is a new one.
- meowface 5y agoIt's not clear if the author reported the newly found vulnerabilities, though. I think most security researchers agree that public disclosure is the only recourse if an entity repeatedly refuses to acknowledge or fix a serious vulnerability. But you have to give them fair opportunities to understand and try to address the vulnerabilities before resorting to that.
- hoseja 5y ago"Open" AI deserves all the shame they get.
- mox1 5y agoThis is a great example of what it is like working vulnerability disclosure intake at a F500. Now receive things like this monthly and try and have a constructive conversation with the reporter.
- h_anna_h 5y agoThe victim here are the people whose stories got exposed, not the company. The company is responsible for not protecting them enough. The public shaming is important to show people that this company is not to be trusted with your data.
- fenomas 5y agoExfiltrating a bunch of data and then poking around to see how sexy it is and then releasing it seems like a strange way to show that the company you took it from isn't trustworthy with data...
- c1ccccc1 5y agoAI Dungeon isn't an individual, it's a business that charges people money to use their product. In the vast majority of cases, responsible disclosure means first telling the developers so they can patch the vulnerability. After it has been fixed, unless there are special circumstances, the fact that there was a security flaw should be disclosed to the public. The purpose of this should not be to shame the developers or anyone else, but to inform the people using the product that there's a chance their info has been compromised. I'm mostly just surprised that AI Dungeon chose not to disclose the first instance of this flaw.