7 ms·

Yeah, what the hell were they doing responding "This is not a bug." without investigating or asking for more details? What the hell is the point of even respond

by Aqueous 13y ago

Yeah, what the hell were they doing responding "This is not a bug." without investigating or asking for more details? What the hell is the point of even responding to possible security alerts from the general public if you're not going to investigate?

future_grad 13y ago
I am curious to how many trash reports they have to sort through to identify real bug reports. Anyone care to comment?
- taspeotis 13y ago
  Microsoft sifts through bogus security reports all the time. Raymond Chen posts the best-of-the-worst periodically. Here are I couple I found: http://blogs.msdn.com/b/oldnewthing/archive/2011/12/15/10247870.aspx http://blogs.msdn.com/b/oldnewthing/archive/2011/12/15/10247... http://blogs.msdn.com/b/oldnewthing/archive/2008/03/14/8080140.aspx http://blogs.msdn.com/b/oldnewthing/archive/2008/03/14/80801...
  - mattmanser 13y ago
    Yeah, but look at what he says in the first link: Before contacting the submitter, we want to be sure that we weren't missing something, but after looking at it from every angle, we still couldn't see what the issue was. ...Stumped, we contacted the submitter. "From what we can tell, the call to system takes place before you call the LoadKeyboardLayout function. Can you elaborate on how this constitutes a vulnerability in the LoadKeyboardLayout function?"
- deleted 13y ago
  [deleted]
- deleted 13y ago
  [deleted]
loceng 13y ago
Yeah, I wonder why the guy who said "This is not a bug." isn't actually the one getting in trouble. Clearly I understand why not - but then his actions lead to the person reporting to escalate their actions to get attention. If the "This is not a bug." guy actually helped guide the person reporting to the proper, expected actions, then this would have likely gone completely differently.
- ajross 13y ago
  Surely that person is in trouble, or will be once the relevant bureaucracy gets back on Monday morning. This is just a huge embarassment, and exactly the opposite of proper security analysis. But no one is going to admit that externally until all the internal work has been done.
  - loceng 13y ago
    It's an assumption that they even care or are looking into it. So far the resulted outcome is they are blaming the guy who didn't follow "their rules" (that wouldn't likely have been clear to him due to a language barrier). This should hit mainstream media though - because if that kind of bug exists, what else exists that Facebook doesn't even know about, that's being taken advantage of?

by Aqueous 13y ago

future_grad 13y ago

I am curious to how many trash reports they have to sort through to identify real bug reports. Anyone care to comment?

taspeotis 13y ago
Microsoft sifts through bogus security reports all the time. Raymond Chen posts the best-of-the-worst periodically. Here are I couple I found: http://blogs.msdn.com/b/oldnewthing/archive/2011/12/15/10247870.aspx http://blogs.msdn.com/b/oldnewthing/archive/2011/12/15/10247... http://blogs.msdn.com/b/oldnewthing/archive/2008/03/14/8080140.aspx http://blogs.msdn.com/b/oldnewthing/archive/2008/03/14/80801...
- mattmanser 13y ago
  Yeah, but look at what he says in the first link: Before contacting the submitter, we want to be sure that we weren't missing something, but after looking at it from every angle, we still couldn't see what the issue was. ...Stumped, we contacted the submitter. "From what we can tell, the call to system takes place before you call the LoadKeyboardLayout function. Can you elaborate on how this constitutes a vulnerability in the LoadKeyboardLayout function?"
deleted 13y ago
[deleted]
deleted 13y ago
[deleted]

loceng 13y ago

Yeah, I wonder why the guy who said "This is not a bug." isn't actually the one getting in trouble. Clearly I understand why not - but then his actions lead to the person reporting to escalate their actions to get attention. If the "This is not a bug." guy actually helped guide the person reporting to the proper, expected actions, then this would have likely gone completely differently.

ajross 13y ago
Surely that person is in trouble, or will be once the relevant bureaucracy gets back on Monday morning. This is just a huge embarassment, and exactly the opposite of proper security analysis. But no one is going to admit that externally until all the internal work has been done.
- loceng 13y ago
  It's an assumption that they even care or are looking into it. So far the resulted outcome is they are blaming the guy who didn't follow "their rules" (that wouldn't likely have been clear to him due to a language barrier). This should hit mainstream media though - because if that kind of bug exists, what else exists that Facebook doesn't even know about, that's being taken advantage of?