5 ms·
Shame on github for making these mistakes in the first place, but kudos to them for doing such a great job of engaging the white hats.
by intortus 13y ago
Shame on github for making these mistakes in the first place, but kudos to them for doing such a great job of engaging the white hats.
- akerl_ 13y agoIf we're shaming any code with security flaws, no one is free of shame. I'm excited by the bounty program, it's a great way to get things like this identified and responsibly disclosed
- intortus 13y agoI agree that flaws will always exist, but I don't understand why it's ever worth it to not be absolutely strict about matching redirect_uri in OAuth.
- homakov 13y agoIt's hard to shame github for those bugs. All of them are low-sev separately, only together they make sense.
- shill 13y agoNice work Egor. I hope to see a GitHub client testimonial on sakurity.com sometime soon.
- patcon 13y agoSorry, but this is a terrible approach to thinking about progressive and open security practices...