4 ms·
Ask HN: How Long to Wait with Responsible Disclosure?
So, I found a pretty serious vulnerability in a major website. I won't go into great detail, but the vulnerability makes it terribly easy for a malicious user to harvest usernames & passwords in plaintext.
The offending site has not published a responsible disclosure agreement anywhere. I sent them an email letting them know about the issue, and would like to give them time to respond to/fix the issue.
How long would you usually wait before publicizing something like this? I don't want to throw them under the bus, but I also recognize that public pressure usually speeds up the response time.
- dougbarrett 13y agowho exactly did you contact? I know that sometimes the 'Contact Us' forms can go to a CS team member, then just added to the dev queue...but if you send it directly to the CEO or to the board (if they have one) then it will be fixed very quickly.
- dgroves 13y ago"Responsible disclosure" is just corporate marketing to brainwash security researchers into allowing corporations to eliminate any 'bad press' of their negligence to protect customer data that they vacuum up. Are they paying you for your work? I didn't think so. No free bugs. Stop pandering to corporations who are to greedy to spend on even the most basic security systems to protect customer data because it cuts into their profits.