4 ms·

They mentioned something about it on the thread that they were transitioning to a new system - plus the fact that nobody saw it as a vulnerability. I guess tha

They mentioned something about it on the thread that they were transitioning to a new system - plus the fact that nobody saw it as a vulnerability. I guess that's the reason

tptacek 13y ago
Apropos nothing else and without judging the actual report you're referring to: if you set up a "whitehat@yourdomain" or "security@yourdomain" alias, you need to be responsive. You can't ignore good-faith messages because you don't think they're valid. You have to act like all good-faith messages are urgent. Those aliases are cheap insurance, but they aren't free: they'll cost you some tech support cycles.
- taylorbuley 13y ago
  Cheap, sure, but they'll cost you plenty in "lost face" when we journos write that you ignored inbound alerts from the person who later published something out of frustration. Not just emails, either. See also event logging: https://www.schneier.com/blog/archives/2014/03/details_of_the_.html https://www.schneier.com/blog/archives/2014/03/details_of_th...
  - haakon 13y ago
    Seriously, this. They are being nonchalant about this whole thing, but it may be damaging their most valuable asset - the community's trust in them. Just don't ignore repeated attempts to contact your whitehat address.
- jakejake 13y ago
  Not saying it was a good reason. Just that they did address the question.
  - danielweber 13y ago
    http://blog.shubh.am/full-disclosure-coinbase-security/ http://blog.shubh.am/full-disclosure-coinbase-security/ According to the original researcher, he mailed them and got no response, and got no response at all from several other attempts at contact,. I wouldn't be surprised one bit to find that the inbox for that address is full of spam and crackpots, but, like 'tptacek said, if you're going to have the list you had better dedicate resources to reading it.
- droopyEyelids 13y ago
  They're actually downright expensive addresses to maintain, and they don't cost tech support cycles, they cost security engineer time. A basic tech support person might be able to fend off the dozens of word salad "security notifications" sent by ESL students, but as they get more complicated and no less often irrelevant, you need people who actually know how your infrastructure works. On top of the technical hassle comes the customer experience hassle of keeping a bunch of wanna be hackers happy as they demand rewards and their name on your site for their idea of a CRSF vulnerability that happens to have no basis in reality.
  - tptacek 13y ago
    The backlash against these aliases is perceptible, but remember that the worst-case scenarios we're talking about today, when those addresses aren't properly staffed, was the default case before they became a common feature of startups.

They mentioned something about it on the thread that they were transitioning to a new system - plus the fact that nobody saw it as a vulnerability. I guess that's the reason

tptacek 13y ago

Apropos nothing else and without judging the actual report you're referring to: if you set up a "whitehat@yourdomain" or "security@yourdomain" alias, you need to be responsive. You can't ignore good-faith messages because you don't think they're valid. You have to act like all good-faith messages are urgent. Those aliases are cheap insurance, but they aren't free: they'll cost you some tech support cycles.

taylorbuley 13y ago
Cheap, sure, but they'll cost you plenty in "lost face" when we journos write that you ignored inbound alerts from the person who later published something out of frustration. Not just emails, either. See also event logging: https://www.schneier.com/blog/archives/2014/03/details_of_the_.html https://www.schneier.com/blog/archives/2014/03/details_of_th...
- haakon 13y ago
  Seriously, this. They are being nonchalant about this whole thing, but it may be damaging their most valuable asset - the community's trust in them. Just don't ignore repeated attempts to contact your whitehat address.
jakejake 13y ago
Not saying it was a good reason. Just that they did address the question.
- danielweber 13y ago
  http://blog.shubh.am/full-disclosure-coinbase-security/ http://blog.shubh.am/full-disclosure-coinbase-security/ According to the original researcher, he mailed them and got no response, and got no response at all from several other attempts at contact,. I wouldn't be surprised one bit to find that the inbox for that address is full of spam and crackpots, but, like 'tptacek said, if you're going to have the list you had better dedicate resources to reading it.
droopyEyelids 13y ago
They're actually downright expensive addresses to maintain, and they don't cost tech support cycles, they cost security engineer time. A basic tech support person might be able to fend off the dozens of word salad "security notifications" sent by ESL students, but as they get more complicated and no less often irrelevant, you need people who actually know how your infrastructure works. On top of the technical hassle comes the customer experience hassle of keeping a bunch of wanna be hackers happy as they demand rewards and their name on your site for their idea of a CRSF vulnerability that happens to have no basis in reality.
- tptacek 13y ago
  The backlash against these aliases is perceptible, but remember that the worst-case scenarios we're talking about today, when those addresses aren't properly staffed, was the default case before they became a common feature of startups.