4 ms·
...and now, all future holes in that site will be sold instead of reported to the owners. I'm fine with that.
by blueskin_ 13y ago
...and now, all future holes in that site will be sold instead of reported to the owners.
I'm fine with that.
- falcolas 13y agoThe problem is that this property transfers to other websites. I'd much rather a 16 year old report problems with my website to me, but if she doesn't because of fears that I will call the police as other webmasters have, I'm worse off as a result. This is bad news for everyone who runs a website.
- jaryd 13y agoThis highlights the importance of having a visible bug bounty program (or at least something very basic) that clearly states that you take security seriously and appreciate/reward (whatever you prefer) bug reports from security researchers.
- ZoFreX 13y agoThis is why you should have a page describing your security reporting process. > (1) Have a security contact, (2) publish a GPG key and accept GPG mail, (3) respond promptly with a "security flaw ID". https://news.ycombinator.com/item?id=640367 https://news.ycombinator.com/item?id=640367
- corin_ 13y agoIt's a Government site, there's really no up-side to future issues being sold.