4 ms·
> Nov 29: We disclose issue to CTO & Security team with video examples > Nov 29: Writer responds, asking for more details > Nov 29: We respond describing the
by wackget 3y ago
> Nov 29: We disclose issue to CTO & Security team with video examples
> Nov 29: Writer responds, asking for more details
> Nov 29: We respond describing the exploit in more detail with screenshots
> Dec 1: We follow up
> Dec 4: We follow up with re-recorded video with voiceover asking about their responsible disclosure policy
> Dec 5: Writer responds “We do not consider this to be a security issue since the real customer accounts do not have access to any website.”
> Dec 5: We explain that paid customer accounts have the same vulnerability, and inform them that we are writing a post about the vulnerability so consumers are aware. No response from the Writer team after this point in time.
Wow, they went to way too much effort when Writer.com clearly doesn't give a shit.
Frankly I can't believe they went to so much trouble. Writer.com - or any competent developer, really - should have understood the problem immediately, even before launching their AI-enabled product. If your AI can parse untrusted content (i.e. web pages) and has access to private data, then you should have tested for this kind of inevitability.
- bee_rider 3y agoI think it is a reasonable amount of effort. Writer might not deserve better, but their customers do, so it is good to play it safe with this sort of thing.
- tech_ken 3y agoI assumed some kind of CYA on the part of PromptArmor. Seems better to go the extra mile and disclose thoroughly rather than wind up on the wrong side of a computer fraud lawsuit. Embarassing for Writer.com that they handled it like this
- deleted 3y ago[deleted]
- lucb1e 3y agoI particularly hate their initial request because it's so asymmetric in the amount of effort. In my experience (from maybe a dozen disclosures), when they don't feel like taking action on your report, they just write a one-sentence response asking for more details. Now you have a choice: A: Clarify the whole thing again with even more detail and different wording because apparently the words you used last time are not understood by the reader. B: Not to waste your time, but that leaves innocent users vulnerable... My experience with option A is that it now gets closed for being out of scope, or perhaps they ask for something silly. (One example of the latter case: the party I was disclosing to requested a demonstration, but the attack was that their closed-source servers could break the end-to-end encrypted chat session... I wasn't going to try hacking their server, and reverse engineering the protocol to create a whole new chat server based on that and then recompiling the client with my new server configured, just to record a video of the attack in action, was a bit beyond my level of caring, especially since the issue is exceedingly basic. They're vulnerable to this day.) TL;DR: When maintainers intend to fix real issues without needing media attention as motivation, and assuming the report wasn't truly vague to begin with, "asking for more details" doesn't happen a lot.
- zer0c00ler 3y ago[dead]