4 ms·

No matter how egregious the security risk is, I have a hard time taking anyone who uses twitter to contact someone they want to do business with seriously. Or a

No matter how egregious the security risk is, I have a hard time taking anyone who uses twitter to contact someone they want to do business with seriously. Or any social media, tbh. It comes off as unprofessional to me, and it is especially unbecoming if you are a security researcher and this is the first resort. It immediately removes any chance of them handling the issue discreetly, and puts them in a defensive position. Why the hell would you do that?

deutronium 11y ago
Yeah I was thinking that, surely an e-mail would be the first point of call rather than mentioning it in public. Also using public tweets doesn't seem particularly professional to me, to start a discussion on vulnerabilities.
- pm24601 11y ago
  this is the way sec. researchers make that first contact. Easiest way to reach a live person. With email, it can be hard to find on a website that isn't just a generic email address that will go to someone who has no clue. Paul made the effort - TPJ attacked.
marak830 11y ago
I agree with you, but surely replying woth an email address would have been the logical thing todo, instead of a passive agressive "its on our website. His explanation of it veing to find a more accurate email adress is understood, although i would have probably just emailed the default on the site and asked via there.
chickenheads 11y ago
the author of the blog post didn't publish his email to the guy who's site was vulnerable. Only the site's reply. I could only imagine how the original email to the company was worded. There's something here about treating someone, even an ignorant idiot (whose only fault is being ignorantly and aggressively presumptuous), with a basic level of professional courtesy. You either foster that basic level of respect or you act like a child in need of attention. I would never hire this security researcher if I read this blog post. Communication is one of our most important skills.
- pm24601 11y ago
  Who cares about hiring Paul? TPJ is ignoring the vulns that Paul is trying to inform them of discretely. As a consequence of TPJ's attitude - Paul is doing the next best thing of letting TPJ customers know that they are at risk.
tptacek 11y ago
Software security people routinely make contact with affected vendors through Twitter, so you're going to have a hard time with the whole field.
mmahemoff 11y ago
Seems fine to me, considering the company doesn't advertise any security email. The researcher has a solid Twitter profile that establishes he's not some time-waster/spammer and in that sense, it's easier for the company to take his approach seriously than if he'd sent a random email in to sales@. Had the company done the right thing and taken him seriously, it would have led to a faster escalation on that basis. He could have immediately emailed the issue and the company would know to expect it and who they're dealing with.
pm24601 11y ago
Paul is doing TPJ a favor - why should Paul exert a huge amount of effort? It was probably the easy way to contact them. Paul is right to not want to talk over the phone: Large amount of time + hard to clear explain exact vulnerability to non-technical types.

deutronium 11y ago

Yeah I was thinking that, surely an e-mail would be the first point of call rather than mentioning it in public. Also using public tweets doesn't seem particularly professional to me, to start a discussion on vulnerabilities.

pm24601 11y ago
this is the way sec. researchers make that first contact. Easiest way to reach a live person. With email, it can be hard to find on a website that isn't just a generic email address that will go to someone who has no clue. Paul made the effort - TPJ attacked.

marak830 11y ago

I agree with you, but surely replying woth an email address would have been the logical thing todo, instead of a passive agressive "its on our website. His explanation of it veing to find a more accurate email adress is understood, although i would have probably just emailed the default on the site and asked via there.

chickenheads 11y ago

the author of the blog post didn't publish his email to the guy who's site was vulnerable. Only the site's reply. I could only imagine how the original email to the company was worded. There's something here about treating someone, even an ignorant idiot (whose only fault is being ignorantly and aggressively presumptuous), with a basic level of professional courtesy. You either foster that basic level of respect or you act like a child in need of attention. I would never hire this security researcher if I read this blog post. Communication is one of our most important skills.

pm24601 11y ago
Who cares about hiring Paul? TPJ is ignoring the vulns that Paul is trying to inform them of discretely. As a consequence of TPJ's attitude - Paul is doing the next best thing of letting TPJ customers know that they are at risk.

tptacek 11y ago

Software security people routinely make contact with affected vendors through Twitter, so you're going to have a hard time with the whole field.

mmahemoff 11y ago

Seems fine to me, considering the company doesn't advertise any security email. The researcher has a solid Twitter profile that establishes he's not some time-waster/spammer and in that sense, it's easier for the company to take his approach seriously than if he'd sent a random email in to sales@. Had the company done the right thing and taken him seriously, it would have led to a faster escalation on that basis. He could have immediately emailed the issue and the company would know to expect it and who they're dealing with.

pm24601 11y ago

Paul is doing TPJ a favor - why should Paul exert a huge amount of effort? It was probably the easy way to contact them. Paul is right to not want to talk over the phone: Large amount of time + hard to clear explain exact vulnerability to non-technical types.