Tagged Questions
4
votes
1answer
45 views
How to encourage responsible disclosure (and react appropriately otherwise)
As a conscious programmer, I put security as one of the core requirements of every product I develop. To prevent flaws from being introduced, I promote a culture of awareness (e.g. make sure that team ...
3
votes
3answers
96 views
Responsible Disclosures and Getting Sued
Lots of websites like Google, Facebook etc acknowledge the white hat hackers on their sites for reporting security vulnerability. But for the vulnerability reporter is it safe from legal perspective ? ...
32
votes
5answers
782 views
How do I respond to a published security vulnerability in my application?
In my spare time I write some PHP code the purpose of which is to block link spam and other various malicious activity.
On May 11 someone who discovered an XSS vulnerability in the WordPress version ...
23
votes
7answers
607 views
Fostering an environment where honesty and disclosure are valued
UPDATE: The question is seeking real research based on behavior analysis of a significantly large sample people using well defined experiments. Posting answers based on opinions, or ad-hoc ...
5
votes
3answers
210 views
Disclosing security vulnerabilities to paying customers first
Particular case
An (unnamed) vendor of an open source product also sells commercial licenses and support. One of the advantages of the commercial deal is that you get notified of security ...
17
votes
2answers
456 views
How to handle security issues of someone else's website
A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
5
votes
5answers
270 views
Effect of Source Code Leakage of a security suite on security
I am interested to know what threats does it pose, if the source code of a security suite is leaked. It came to my mind after reading the following URLs:
...
