3 ms·
Good find and nice writeup, but this disclosure timeline is pretty harsh! > 01/17/15 [Saturday] Initial discovery and attempt to reach GoDaddy security. > 01/
by ireflect 12y ago
Good find and nice writeup, but this disclosure timeline is pretty harsh!
> 01/17/15 [Saturday] Initial discovery and attempt to reach GoDaddy security.
> 01/18/15 [Sunday] Further attempts to reach GoDaddy security, finally received word there was no timeline for a fix.
That GoDaddy acknowledged the issue after only a day (over a weekend, no less) is impressive. Surely they deserve another few days to figure out a timeline for a fix.
- xordon 12y ago> 1/19/15 [Monday] GoDaddy implemented CSRF protection for sensitive account actions.
- bdonlan 12y agoYeah, it's totally reasonable that they won't have a timeline the day they got the report. And if they fix it the next day, who cares that they didn't give an ETA? Clearly they had better things to do than reporting back.