4 ms·
I for one think it's a seriously unrealistic expectation to think that AMEX or insert large corp here will handle security vulnerabilities over twitter. It's t
by phillmv 15y ago
I for one think it's a seriously unrealistic expectation to think that AMEX or insert large corp here will handle security vulnerabilities over twitter.
It's the equivalent of telling a teller or their doorman about it.
- nknight 15y agoHe was trying to handle it over email. He was just asking the doorman for directions to the manager's office.
- eli 15y agoNo, he did not appear to want to discuss it over twitter either. They offered that. I assume he was looking for a specific email address and perhaps a PGP key. Sure, that would be nice. But using the telephone is a pretty common method of transmitting important, time-sensitive information.
- A1kmm 15y agoWorrying about keeping the information private is inconsistent with posting it publicly.
- Natsu 15y agoTo be fair, he asked repeatedly for a proper security contact and claims they don't publish one for whatever reason. If the only way to contact you is through clueless support people who have a script that doesn't include your option, yeah, that's a problem. But usually it's the customer who is screwed by this. This time, it bit the company instead. That said, you can always ask if someone knows a security contact on BugTraq. Someone there will probably know.
- tibbon 15y agoAs someone who does community management/marketing, I take claims like security issues very seriously. If someone at 4pm messaged such over Twitter to my startup, I'd call the CEO and all engineers immediately, regardless of the time. I don't think I'm a doorman there, but rather the first line of defense/listening.
- reinhardt 15y agoThe key word in your post is "startup". Most CSRs of AMEX have probably not even seen their CEO in person, let alone "call him immediately".
- phillmv 15y agoTheir bosses bosses' have never seen their CEOs. I bet you there's a good chance a CSR doesn't even know their CEO's name. I certainly didn't back when I worked at $IMMENSE_FINANCIAL_INSTITUTIONs
- wnight 15y agoThe hacker didn't want to use Twitter either... And what do you think the doorman/receptionist is for?
- saurik 15y ago> I for one think it's a seriously unrealistic expectation to think that AMEX or insert large corp here will handle security vulnerabilities over twitter. a) Agree. b) That said, I think the fact that the person on the other end of the American Express Twitter account was accepting to talk to the guy over DM, and thereby actually /was/ willing to handle a security vulnerability over Twitter, is the most damning argument against this guy's rant; he insisted on using a "modern protocol", but apparently telling someone using Twitter, when they were perfectly happy to let him do so, was not modern enough: he insisted it be on his terms or no terms, e-mail or nothing.