4 ms·
What is proper etiquette for responsible disclosure? Hacker: "I'm publishing on the 15th." Vendor: "We'd like to see your post first" Hacker: "Ok, here you g
by pilom 13y ago
What is proper etiquette for responsible disclosure?
Hacker: "I'm publishing on the 15th."
Vendor: "We'd like to see your post first"
Hacker: "Ok, here you go"
15th comes and goes
Hacker: "Hey any response?"
Hacker: "Ok its the 18th... I'm publishing"
Is this how this usually works? Or how it should work?
- mason55 13y agoA full month of notification is plenty. If the vendor acknowledges you and tells you they're working on it and asks you to hold off then that's one thing, but if they basically ignore you for a month then you've done your part. Especially with an exploit like this, you're not opening up access to PII, although it sounds like you are opening the window to possible fraudulent charges.
- lawnchair_larry 13y agoNo, disclosure timelines only make sense if the public is at risk. There is nothing like that here. The outcome is gogo not getting paid. This is just grandstanding a fairly unsophisticated bug in their service. The end result is that gogo will end up with more money.
- mason55 13y ago> disclosure timelines only make sense if the public is at risk The post says that fraudulent charges can be made without a password or credit card number by using this exploit. I would bet that you can access account info as well which means there is some PII leaking. I would consider PII + fraudulent transactions to be a step above gogo losing oney.
- deleted 13y ago[deleted]