4 ms·
> We had difficulty identifying the right disclosure contact for this issue. We did not want to contact FlyCASS first as it appeared to be operated only by one
by jrochkind1 2y ago
> We had difficulty identifying the right disclosure contact for this issue. We did not want to contact FlyCASS first as it appeared to be operated only by one person and we did not want to alarm them.
Wait, what? Is this a euphemism for they didn't believe they would take it seriously? Reporting it over their heads to DHS was probably not less "alarming" to anyone...
- gmueckl 2y agoThis is confusing to me as well. You could always escalate later, right?
- filoeleven 2y agoI’m wondering if their thinking was: if they contacted the sole developer, and he perceived it as a threat (whether security or personal livelihood) then the deck is stacked against them when they then have to escalate. The dev has already said “some hackers say they hacked my service” to TSA and kicked the beehive. I wouldn’t have a clue who to report it to myself; the record of DHS is pretty awful too. Lots of folks are saying (and one even betting on!) them being charged for their find within the next couple of years, and given US federal agencies’ records when it comes to these vulns I’d be quite worried about it too if I had found it.
- rjh29 2y agoReal reason: the dev would fix it and they'd be stuffed. That doesn't encourage the DHS to actually look into the issue and see what else is broken.