3 ms·
I always, always, always go the route of contacting vendors - over the past 15 years I have reported hundreds of security and privacy vulnerabilities. This is t
by nikcub 14y ago
I always, always, always go the route of contacting vendors - over the past 15 years I have reported hundreds of security and privacy vulnerabilities. This is the first time where I haven't reported to the vendor first before disclosing.
The way this came about was a bit different, because it started with a tweet[1] where I pointed out that the file was there, and then it gradually developed into realizing that it is a pretty big deal. The discovery happen out in the open. If you look at my timeline and the replies and conversations you will see how it came about.
With hindsight I could have handled it differently, but it just happen to come out in this way. I added an update to the end of the post addressing disclosure. The goal at the moment is to make users aware that there is potentially a big issue here.
[1] https://twitter.com/nikcub/status/205489752684765185 https://twitter.com/nikcub/status/205489752684765185
- iuguy 14y agoIt's your bug, finders keepers. I always despair when I hear people talk about 'responsible disclosure', as it's a term so often used by vendors to keep finders quiet. By disclosing it at all you've highlighted the issue and Yahoo have rightly moved to fix it quickly. So I can sign a chrome extension with a valid cert for maybe a day, it's not the end of the world.
- lawnchair_larry 14y agoI too hate that term. Even Microsoft rejects it.
- tptacek 14y agoThere was zero (0) chance this wasn't going to get found 100 times independently whether or not you publicized it. Getting it out quick and loudly was absolutely the right move. You have nothing at all to apologize for.
- nikcub 14y agothanks. and you are right, at least two other people found the same thing, then searched twitter and found my post about it. one of them was @rasmus the creator of PHP (pretty funny timeline of him discovering and then finding on twitter).