3 ms·

And thus, once again, it's proven that full and anonymous public disclosure is the only way to notify website owners of their vulnerabilities.

• sharpneli 13y ago
  And every time that happens a bunch of apologists appear shouting "Why didn't they inform the site operators first? That is really irresponsible" And then some poor teen believes it and thinks "maybe it's wise to inform the site first" and subsequently goes to jail for doing the 'responsible' thing. And so the cycle continues.
  • pavel_lishin 13y ago
    Wouldn't combining the two tactics be the actually responsible thing to do? Inform the operators anonymously, and tell them that in four weeks a copy of this e-mail will be publicized.
    • dkuntz2 13y ago
      Because that might seem like blackmail to some people...
      • mandelbulb 13y ago
        You definitely have to phrase it kindly and explicit and be open for other options of how to proceed. Otherwise, the point of staying anonymous is to protect oneself from unnecessarily enraged admins or other responsible people.