3 ms·

When you find a bug which amounts to a security vulnerability, you should inform them privately and then make it public after a reasonable amount of time has pa

When you find a bug which amounts to a security vulnerability, you should inform them privately and then make it public after a reasonable amount of time has passed and preferably after it's been fixed. By making it public right from the get-go, anyone who sees this bug report can now attack any system that uses MongoDB. Do you think that's OK?

CJefferson 13y ago
Is it the height of professionalism? No. However, I've written similarly irate messages at 4 or 5am, particularly after spending months working on a product. And this level of coding quality is unacceptable in any product which wants to be large-scale deployed on the internet.
- MichaelAza 13y ago
  It is beyond unprofessional, it's down right dangerous. Obviously the guy is not a security researcher so he's probably not aware of proper disclosure protocol but seeing as he's fully aware this bug is exploitable ("Step 8. REALIZE I CAN CRASH 99% OF ALL WEB 3.9 SHIT-TASTIC WEBSCALE MONGO-DEPLOYING SERVICES WITH 16 BYTE POST") doing it this way is really not excusable, no matter how pissed you are.
  - sp332 13y ago
    Anyone looking for this vulnerability could run a static analyzer on the MongoDB codebase and they would have found this bug already.
    - MichaelAza 13y ago
      Think of it this way - a professional might have done what you're suggesting. Now, any script kiddie can exploit it.
PeterisP 13y ago
It's not optimal, but it's certainly allowed/ok, and it's far better than NOT posting that in the bugreport forum. Proper disclosure takes effort. The product owner can offer bounties to motivate others to make that effort for them. But if you can't/won't spend that effort, then it's still better to publish the bug than not publish it.
- MichaelAza 13y ago
  I agree proper disclosure take effort but even if he was to send them the very same text privately instead of posting it to the bug tracker it would have been better.
  - Garoof 13y ago
    Maybe if it's only about getting some bug fixed as soon as possible. But I'd say communicating the "MongoDB is terrible" part of it to the public is pretty valuable too. Because nice to know and the hype doesn't mention that so much. I'm sure we can come up with a best way to go about things. I'm not really cool with the "oh Mike" part of it. But I think it's mostly okayish. Certainly a lot more okay than the bug.

CJefferson 13y ago

Is it the height of professionalism? No. However, I've written similarly irate messages at 4 or 5am, particularly after spending months working on a product. And this level of coding quality is unacceptable in any product which wants to be large-scale deployed on the internet.

MichaelAza 13y ago
It is beyond unprofessional, it's down right dangerous. Obviously the guy is not a security researcher so he's probably not aware of proper disclosure protocol but seeing as he's fully aware this bug is exploitable ("Step 8. REALIZE I CAN CRASH 99% OF ALL WEB 3.9 SHIT-TASTIC WEBSCALE MONGO-DEPLOYING SERVICES WITH 16 BYTE POST") doing it this way is really not excusable, no matter how pissed you are.
- sp332 13y ago
  Anyone looking for this vulnerability could run a static analyzer on the MongoDB codebase and they would have found this bug already.
  - MichaelAza 13y ago
    Think of it this way - a professional might have done what you're suggesting. Now, any script kiddie can exploit it.

PeterisP 13y ago

It's not optimal, but it's certainly allowed/ok, and it's far better than NOT posting that in the bugreport forum. Proper disclosure takes effort. The product owner can offer bounties to motivate others to make that effort for them. But if you can't/won't spend that effort, then it's still better to publish the bug than not publish it.

MichaelAza 13y ago
I agree proper disclosure take effort but even if he was to send them the very same text privately instead of posting it to the bug tracker it would have been better.
- Garoof 13y ago
  Maybe if it's only about getting some bug fixed as soon as possible. But I'd say communicating the "MongoDB is terrible" part of it to the public is pretty valuable too. Because nice to know and the hype doesn't mention that so much. I'm sure we can come up with a best way to go about things. I'm not really cool with the "oh Mike" part of it. But I think it's mostly okayish. Certainly a lot more okay than the bug.