4 ms·

There's a few posts here about non-responsible disclosure. Having read the post they certainly disclosed this to a number of vendors, or at least seem to have.

There's a few posts here about non-responsible disclosure. Having read the post they certainly disclosed this to a number of vendors, or at least seem to have. Is this a case of them not disclosing it to every vendor?

jammaloo 3y ago
Not disclosing it to postfix is the biggest issue I'm seeing people talk about. From the article they reached out to three of the biggest individual vendors, but there's no indication of them disclosing it to postfix or any of the other providers of mail server software. In the article they even mention that postfix is affected, and show it as being the most used mail server online, by a large margin.
zx8080 3y ago
Could it be that they disclosed it to anyone who was willing to buy their services/sign their contract? They seem to be a business, not some students from academy.
- varjag 3y ago
  A very irresponsible business at that.
  - VBprogrammer 3y ago
    I suppose they could have just sold it to the highest bidder.
    - varjag 3y ago
      They probably have sold it to several bidders, the legit kind ones that don't warrant a knock from the Homeland and don't pay in Monero.
- Aachen 3y ago
  That seems very unlikely. As someone in the industry, I haven't heard of commercial businesses doing that, and in fact know of one court case in the Netherlands a handful of years back where someone tried that ("would be a shame if it became public, I could fix if you pay me x") and got sued for extortion (not sure if the phrasing was exceedingly poor but not intended maliciously and the court acquitted, or if they got convicted; there may have been two such cases, one malicious and one not, and I'm mixing them up) My employer (me included) does similar disclosures to vendors and open source projects. Being paid is never a condition for doing responsible/coordinated disclosure. I can't speak for others but, given the extortion allegation risk, I have trouble imagining this is how it went down Much more common is being afraid it leaks due to patches landing too early or people talking, and so limiting it to the biggest vendors out there. In this case, I'd say they could definitely have done more coordinated disclosures without risking that...
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]

jammaloo 3y ago

Not disclosing it to postfix is the biggest issue I'm seeing people talk about. From the article they reached out to three of the biggest individual vendors, but there's no indication of them disclosing it to postfix or any of the other providers of mail server software. In the article they even mention that postfix is affected, and show it as being the most used mail server online, by a large margin.

zx8080 3y ago

Could it be that they disclosed it to anyone who was willing to buy their services/sign their contract? They seem to be a business, not some students from academy.

varjag 3y ago
A very irresponsible business at that.
- VBprogrammer 3y ago
  I suppose they could have just sold it to the highest bidder.
  - varjag 3y ago
    They probably have sold it to several bidders, the legit kind ones that don't warrant a knock from the Homeland and don't pay in Monero.
Aachen 3y ago
That seems very unlikely. As someone in the industry, I haven't heard of commercial businesses doing that, and in fact know of one court case in the Netherlands a handful of years back where someone tried that ("would be a shame if it became public, I could fix if you pay me x") and got sued for extortion (not sure if the phrasing was exceedingly poor but not intended maliciously and the court acquitted, or if they got convicted; there may have been two such cases, one malicious and one not, and I'm mixing them up) My employer (me included) does similar disclosures to vendors and open source projects. Being paid is never a condition for doing responsible/coordinated disclosure. I can't speak for others but, given the extortion allegation risk, I have trouble imagining this is how it went down Much more common is being afraid it leaks due to patches landing too early or people talking, and so limiting it to the biggest vendors out there. In this case, I'd say they could definitely have done more coordinated disclosures without risking that...

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]