4 ms·

I feel like every 2-3 months a blog post rockets to the top of HN where a hacker discloses a vuln and says “I reported this to $company 10 months ago and it is

I feel like every 2-3 months a blog post rockets to the top of HN where a hacker discloses a vuln and says “I reported this to $company 10 months ago and it is still present in the most recent version of $OS”. If it’s AppAmaGooSoft they can take the hit (especially if it turns out to not be that bad) but I imagine for a smaller company (like one of the more indie cloud hosts) that could be damaging to their reputation among the folks who hang out here (many of whom purchase cloud hosting and other tech stuff).

tptacek 5y ago
Let me put it this way: I've never seen one of these beg-bounty people publicly shame a company for not fixing their SPF records. I think the reason for that is that it wouldn't work, but either way: it's not a real threat. I don't even see evidence of the threat being made!
toast0 5y ago
IMHO, what looks bad is when the company responds and asks for more time and more time and doesn't seem to be doing anything concrete. That shows lack of communication and coordination which looks worse than maybe missing one email or customer service request. Email doesn't always get delivered and customer service requests don't always get read by people who are empowered to do anything about it. If there's a pattern of not acting on emails, that may be different. All that said, security reputation doesn't seem like super important. I'm having trouble thinking of companies that have failed because of poor reputation in that area, despite having a desirable product otherwise. I'm not suggesting not to care about security, just that worrying about your reputation shouldn't be on your list of worries. Given that as an industry, we're still making the same security mistakes over and over, trying your best and learning from previous mistakes is a pretty good baseline. You can still get relative praise for reacting quickly and effectively to reports that are made public, even if you missed the early warning.

tptacek 5y ago

Let me put it this way: I've never seen one of these beg-bounty people publicly shame a company for not fixing their SPF records. I think the reason for that is that it wouldn't work, but either way: it's not a real threat. I don't even see evidence of the threat being made!

toast0 5y ago

IMHO, what looks bad is when the company responds and asks for more time and more time and doesn't seem to be doing anything concrete. That shows lack of communication and coordination which looks worse than maybe missing one email or customer service request. Email doesn't always get delivered and customer service requests don't always get read by people who are empowered to do anything about it. If there's a pattern of not acting on emails, that may be different. All that said, security reputation doesn't seem like super important. I'm having trouble thinking of companies that have failed because of poor reputation in that area, despite having a desirable product otherwise. I'm not suggesting not to care about security, just that worrying about your reputation shouldn't be on your list of worries. Given that as an industry, we're still making the same security mistakes over and over, trying your best and learning from previous mistakes is a pretty good baseline. You can still get relative praise for reacting quickly and effectively to reports that are made public, even if you missed the early warning.