3 ms·

> 37,529 restaurants use Dotpe for QR codes. At that scale, it would take years to get fixed without forcing it like this. It's too small for them to care abo

• loktarogar 2y ago
  > At that scale, it would take years to get fixed without forcing it like this. But it also might not take years. The point of responsible disclosure is to give them the opportunity. If they don't take it, fine - that's now on them. Instead this guy is committing fraud with actual financial damages (wasted food) and then sharing how others can commit the same fraud on a massive scale, potentially causing more damage. This is now on him and Dotpe, not Dotpe alone.
  • hunter2_ 2y ago
    > fine - that's now on them Is that legally true? The legal risk of having published this without responsible disclosure vanishes if the conventional period of opportunity is ignored? That smells fishy.
    • loktarogar 2y ago
      I'm not a lawyer so I'm not speaking to the legality of this. Legality is not the only thing that matters. If you publish an exploit without at least making an attempt to fix it, and someone follows you and exploits it, then there's a direct moral line between you and that exploitation. They more likely than not wouldn't have exploited it without you putting that published info in their path. It's now on you, them and the company, morally. Any damages that result from this interaction are because you and the company enabled them to happen. That's different to someone else stumbling on it and exploiting it. That's purely on the company and the exploiter.
• chippiewill 2y ago
  Maybe, maybe not. But in responsible disclosure you usually give a 90 day notice period before publicly disclosing and "forcing" them.