3 ms·
Is it the height of professionalism? No. However, I've written similarly irate messages at 4 or 5am, particularly after spending months working on a product. A
by CJefferson 13y ago
Is it the height of professionalism? No.
However, I've written similarly irate messages at 4 or 5am, particularly after spending months working on a product. And this level of coding quality is unacceptable in any product which wants to be large-scale deployed on the internet.
- MichaelAza 13y agoIt is beyond unprofessional, it's down right dangerous. Obviously the guy is not a security researcher so he's probably not aware of proper disclosure protocol but seeing as he's fully aware this bug is exploitable ("Step 8. REALIZE I CAN CRASH 99% OF ALL WEB 3.9 SHIT-TASTIC WEBSCALE MONGO-DEPLOYING SERVICES WITH 16 BYTE POST") doing it this way is really not excusable, no matter how pissed you are.
- sp332 13y agoAnyone looking for this vulnerability could run a static analyzer on the MongoDB codebase and they would have found this bug already.
- MichaelAza 13y agoThink of it this way - a professional might have done what you're suggesting. Now, any script kiddie can exploit it.