releasing information about security issues to the general public or a selected group.

learn more… | top users | synonyms

13
votes
3answers
1k views

Whistleblowing, business ethics and credit card data

I'm writing this post as I'm facing a personal, ethical dillemma and I would like feedback on the best way to approach this situation, particularly from a philosophical point of view. I work for a ...
18
votes
2answers
708 views

How to handle security issues of someone else's website

A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
31
votes
5answers
4k views

Open Source vs Closed Source Systems

My understanding is that open source systems are commonly believed to be more secure than closed source systems. Reasons for taking either approach, or combination of them, include: cultural norms, ...
5
votes
6answers
1k views

What might be the legal and policy consequences of traffic sniffing?

I found a security hole in an organisation in the UK with many employees. Login form sends user name and password in clear text to the public facing IP via HTTP. Initially I pointed this to IT but ...
11
votes
2answers
365 views

Progress in market approaches to software vulnerability disclosure?

In A Comparison of Market Approaches to Software Vulnerability Disclosure (2006), Rainer Böhme describes the profound role of economic "market failure" in the industry dynamics that hinder software ...
15
votes
3answers
1k views

Which companies facilitate payment in return for vulnerability disclosure?

If requesting payment from an affected party directly for the disclosure of vulnerabilities is considered extortion, how can independent security researchers earn a living or side income from ...
6
votes
5answers
528 views

Effect of Source Code Leakage of a security suite on security

I am interested to know what threats does it pose, if the source code of a security suite is leaked. It came to my mind after reading the following URLs: ...
8
votes
2answers
290 views

How do you address a social engineering and or software weakness/concern in a company or organisation?

Say that you call your bank and are able to start talking about your personal finances, without having given them any real proof of your identity. Well the first thing I'd think would be to change ...
9
votes
2answers
2k views

Is there a way for a consumer to report PCI non compliance?

Is there a way for a consumer to report PCI non compliance?
5
votes
1answer
951 views

Tools to identify and report hacking attempts originating inside reputable organizations?

Re: Should I report hacking attempts? - Server Fault Lots of people look at their own logs for attacks from the outside. But who regularly reports such attacks back to the source? I'm mainly ...
21
votes
3answers
2k views

Where to report malicious URLs, phishing, and malicious web sites?

I recently discovered that my web site was hacked: there was a HTML hidden div selling about shoes... I Googled the text in question and voila: thousands of sites have been hacked. Check this out: ...
4
votes
4answers
664 views

What particular concerns should one bear in mind when wardriving?

I'm considering starting a neighborhood-wide wardrive, with the objective of raising awareness to the risks of running unsecured wireless networks. Right now, I'm still in the planning stages of this ...
13
votes
3answers
760 views

Reporting vulnerable sites

Take this scenario: You browse the web and find a website that is vulnerable to SQL Injection. Being a good guy/gal you report the vulnerability to the site owner (if you are able to find contact ...
8
votes
4answers
567 views

How should I escalate a vulnerability that is dismissed by the vendor?

I've come across a vulnerability that secure@microsoft does not think is worth pursuing. I would estimate that there are many, many customers affected by this issue. I do not want to start a ...
3
votes
5answers
466 views

Was the ASP.NET Padding Oracle exploit exposed in an ethical manner? What could have been done differently?

This is a multi-part question.... In regards to the ASP.NET Padding Oracle, (demo link)was that security exploit dealt with in an ethical manner? What could have been done differently or better? ...
40
votes
6answers
4k views

How to disclose a security vulnerability in an ethical fashion?

How to disclose a security vulnerability in an ethical way? I've heard there are various schools of thought on this topic. I'd like to know the pros/cons of each.