3 ms·
> Regardless if you want to report a security bug you should include the impact. Assigning impact, even only as a measure of risk, is not the responsibility of
by manuelabeledo 4y ago
> Regardless if you want to report a security bug you should include the impact.
Assigning impact, even only as a measure of risk, is not the responsibility of the reporter.
A reporter must provide a fair description and a proof of concept. Calculating impact involves much more than that.
- bawolff 4y agoI would disagree that it is a fair description without some description of impact. Hell, without impact, its not even a normal bug, let alone a security bug. The fundamentals of a bug report are "I expect X to happen when I do Y, but instead Z happens". Without impact, all you are saying is "I expect X to happen".
- manuelabeledo 4y ago"Impact" is much more than just what happens when a vulnerability is exploited in a vacuum. That is the reason behind CVSS scores and incident response.
- bawolff 4y agoSure, there are different levels of explaining "impact" and the reporter isn't responsible for being the final authority. They should have some idea though as to what the bad thing you can do with the bug is. (However, cvss scores are basically garbage)