5 ms·

4 days from reporting to public posting is not a responsible disclosure policy. Even if they are slow in responding, the usual grace period is about 4 weeks if

4 days from reporting to public posting is not a responsible disclosure policy. Even if they are slow in responding, the usual grace period is about 4 weeks if I recall.

endigma 4y ago
They don't offer a guide or any details about the exploit, this isn't really disclosure in the normal sense. Aside from any possible alterior motives the author may be just trying to light a fire under hive social's ass to get it fixed.
- joe-collins 4y ago
  In kindness and for future reference, the word you're looking for is spelled "ulterior".
yellow_lead 4y ago
This isn't disclosure
p1necone 4y ago
1. They haven't disclosed anything of use to an attacker. 2. According to the post, Hive responded and said the issues had been fixed. Obviously they haven't, and at this point OP seems to have decided that the most responsible thing to do was to warn users of the platform that they aren't safe. I don't really see a problem with this.
- zelon88 4y ago
  > 1. They haven't disclosed anything of use to an attacker. I also don't believe this is "responsible" disclosure, but I also don't think it's fair to say this information is of no use. To me this clearly signifies that there is no back-end authentication on their API. The whole app is probably written in JS with a simple database on the backside with no serious middleware on the server side. It would probably not be difficult to reverse engineer this hack by monitoring requests using simple dev tools, and then simply replaying them with altered content.
  - p1necone 4y ago
    If that's the vuln, then they were going to be cracked wide open by half the script kiddies on the planet as soon as they got any sort of adoption.
    - ThePowerOfFuet 4y ago
      That is precisely what you are seeing here.
      - panzi 4y ago
        I wouldn't call Zerforschung script kiddies, though.
- Kiro 4y ago
  Where does it say Hive claimed the issue had been fixed? I think you misread it.
  - detaro 4y ago
    "After multiple days and multiple reminders by us, they claimed to have fixed all issues."
    - Kiro 4y ago
      It says "After multiple days and multiple reminders by us, they claimed to fix them within the next two days." now.
drunkenmagician 4y ago
So, not disclosure from a security ops / policy perspective, but it is 'disclosure' this the equivalent of a 'here be dragons' comment on a map ... an endorsement for the 'curious'

4 days from reporting to public posting is not a responsible disclosure policy. Even if they are slow in responding, the usual grace period is about 4 weeks if I recall.

endigma 4y ago

They don't offer a guide or any details about the exploit, this isn't really disclosure in the normal sense. Aside from any possible alterior motives the author may be just trying to light a fire under hive social's ass to get it fixed.

joe-collins 4y ago
In kindness and for future reference, the word you're looking for is spelled "ulterior".

yellow_lead 4y ago

This isn't disclosure

p1necone 4y ago

1. They haven't disclosed anything of use to an attacker. 2. According to the post, Hive responded and said the issues had been fixed. Obviously they haven't, and at this point OP seems to have decided that the most responsible thing to do was to warn users of the platform that they aren't safe. I don't really see a problem with this.

zelon88 4y ago
> 1. They haven't disclosed anything of use to an attacker. I also don't believe this is "responsible" disclosure, but I also don't think it's fair to say this information is of no use. To me this clearly signifies that there is no back-end authentication on their API. The whole app is probably written in JS with a simple database on the backside with no serious middleware on the server side. It would probably not be difficult to reverse engineer this hack by monitoring requests using simple dev tools, and then simply replaying them with altered content.
- p1necone 4y ago
  If that's the vuln, then they were going to be cracked wide open by half the script kiddies on the planet as soon as they got any sort of adoption.
  - ThePowerOfFuet 4y ago
    That is precisely what you are seeing here.
    - panzi 4y ago
      I wouldn't call Zerforschung script kiddies, though.
Kiro 4y ago
Where does it say Hive claimed the issue had been fixed? I think you misread it.
- detaro 4y ago
  "After multiple days and multiple reminders by us, they claimed to have fixed all issues."
  - Kiro 4y ago
    It says "After multiple days and multiple reminders by us, they claimed to fix them within the next two days." now.

drunkenmagician 4y ago

So, not disclosure from a security ops / policy perspective, but it is 'disclosure' this the equivalent of a 'here be dragons' comment on a map ... an endorsement for the 'curious'