3 ms·

"If you won't illustrate the impact of our mistake, we aren't obligated to listen to you" is peak CYA

• gavingmiller 2y ago
  Not even close to the point I was making: If you want to get taken seriously, write to audience.
  • Aachen 2y ago
    The audience of a security contact point (be that Hackerone or security@') is a technical person We add impact demonstrations to a few findings per pentest report because our audience is broader: the nontechnical people who decide to allocate the money need to understand why this is useful and that the devs/sysadmins need to get enough time to do things right (developers and sysadmins are often sufficiently skilled, but are under delivery pressure). A sufficiently technical team, when the bug is adequately explained, doesn't need a functional exploit to see it's real/impactful or not
  • 23B1 2y ago
    "My neighbor said he saw smoke coming from my house, but he never said anything about fire!"