3 ms·
Interview with StrongWebmail's $10,000 Hacker
- vnuk 17y agoIs it just me, or I don't see anywhere in this interview that they actually paid up...
- TallGuyShort 17y agoI was wandering the same thing - I remember their blog said "they were investigating whether or not contest rules had been followed". Which is kinda stupid, since attackers don't follow the rules, and could make more than $10,000 by NOT telling you about the vulnerability. Anyway... I really appreciate his emphasis on never expecting things to be "bullet proof". People need to remember that more.
- zackattack 17y agoThey're also totally alienating an important part of the market imo.
- rdj 17y agofwiw, he confirmed the deposit on twitter: http://twitter.com/XSSExploits/status/2186157907 http://twitter.com/XSSExploits/status/2186157907
- sanj 17y agoIs anyone interested in the value provided by Firehost? They seem to have the expertise.
- greg_gti 17y agoFirehost is a new company but their advantage is they built their infrastructure starting with Security and that's their core focus
- TheSOB88 17y agoCool stuff, but I disagree with Lance's last word. The public (not the technically inclined) is going to expect "bullet proof" performance, so saying you aren't is going to hurt you.
- bayareaguy 17y agoThis is a great hack. The company received a message claiming details proving an XSS vulnerability, but the details did not in fact exist until they followed the instructions in the message with the vulnerable interface meaning that in effect the email acted like a call to a function returning a promise[1] which was fulfilled when the message was read. 1- http://en.wikipedia.org/wiki/Futures_and_promises http://en.wikipedia.org/wiki/Futures_and_promises