4 ms·
As a security researcher myself, we've been having the discussion about "right way" and "wrong way" for a long time. The consensus so far is that there is no co
by axoltl 2y ago
As a security researcher myself, we've been having the discussion about "right way" and "wrong way" for a long time. The consensus so far is that there is no consensus, and what the "right way" is changes. When Google Project Zero started doing 90 day disclosure deadlines, many viewed this as the wrong way and irresponsible. Now it's viewed as the only way to do disclosures.
- suprjami 2y ago> The consensus so far is that there is no consensus, and what the "right way" is changes. Ask your coworkers if the "right way" includes leaking the vuln existence early to hype it up for internet clout, which allows anyone smart to guess the component easily, then breaking your own embargo by publishing a PoC a week earlier than agreed and a week earlier than fixes were supposed to come out. If anyone thinks that's the "right way" then suggest they find a job somewhere else. Preferably not in tech at all.
- hn_throwaway_99 2y agoAfter looking more into what happened, this does not appear to be a case of someone using the wrong fork for the salad course. The fact that good people can debate about the right/optimal disclosure procedures doesn't mean that we shouldn't call out easily identifiable cases of crappy behavior.
- axoltl 2y agoFirst off, the salad fork expression is going into my repertoire, it is excellent. Second, I will say that evilsocket has a bit of an abrasive and impulsive communication style and that can make for fairly adversarial conversations. Combine that with developers being somewhat defensive around their code/project, and it's a bit of a powder keg waiting to explode. I'm not sure there's anything to take away from this or lessons to be learned other than that creating some mental space/distance is a good thing.