4 ms·

I found and reported a security issue to Microsoft. They responded nearly right away and it was a real person . I was soon talking directly to the right team to

I found and reported a security issue to Microsoft. They responded nearly right away and it was a real person . I was soon talking directly to the right team to explain it to. I provided assets required to replicate and they jumped right on it and fixed it. They even told me what KB* it was resolved in via follow up email. I didn’t want any kind of monetary reward - just happy to have it fixed. I regularly report security issues in open source projects too. Now, I also once tried to report a fairly serious issue that impacted iOS and MacOS X (at the time) and you’d have thought (naively) they’d have been super interested and helpful as Microsoft were. Wrong. In fact their first response basically meant I never ended up getting past their first auto reply.

dandanua 5y ago
That's a superiority complex. It can be seen especially well in Russia. I've read stories that their companies even start legal actions against white hackers that submit vulnerabilities to them.
- contriban 5y ago
  This sounds like it happens a lot everywhere outside large American companies. The reasoning probably goes like “why were you even trying to break in, that’s illegal.”
  - jbarrs 5y ago
    >why were you even trying to break in Because you're offering money if a way in is found. I feel like that's most of their hesitance, really, they probably just don't want to pay the bounties.
- faeyanpiraat 5y ago
  I’d say it is just incompetence. The group of people who run these corps are old enough not to be grown up with the internet, and some of them just can’t understand the dangers of this new world, even if you tried explaining it to them. They are missing the fundamentals.
  - darig 5y ago
    China understands this. That is why they engineered the China Virus. Thank you China.
- toolslive 5y ago
  Not only in Russia. I once accidentally discovered a vulnerability in a rather popular job search site (EU). I reported it to them only to be harassed by their legal department afterwards. No good deed shall go unpunished.
  - willis936 5y ago
    No bad deed should go unpublished.

dandanua 5y ago

That's a superiority complex. It can be seen especially well in Russia. I've read stories that their companies even start legal actions against white hackers that submit vulnerabilities to them.

contriban 5y ago
This sounds like it happens a lot everywhere outside large American companies. The reasoning probably goes like “why were you even trying to break in, that’s illegal.”
- jbarrs 5y ago
  >why were you even trying to break in Because you're offering money if a way in is found. I feel like that's most of their hesitance, really, they probably just don't want to pay the bounties.
faeyanpiraat 5y ago
I’d say it is just incompetence. The group of people who run these corps are old enough not to be grown up with the internet, and some of them just can’t understand the dangers of this new world, even if you tried explaining it to them. They are missing the fundamentals.
- darig 5y ago
  China understands this. That is why they engineered the China Virus. Thank you China.
toolslive 5y ago
Not only in Russia. I once accidentally discovered a vulnerability in a rather popular job search site (EU). I reported it to them only to be harassed by their legal department afterwards. No good deed shall go unpunished.
- willis936 5y ago
  No bad deed should go unpublished.