7
votes
3answers
220 views

Disclosing security vulnerabilities to paying customers first

Particular case An (unnamed) vendor of an open source product also sells commercial licenses and support. One of the advantages of the commercial deal is that you get notified of security ...
17
votes
2answers
563 views

How to handle security issues of someone else's website

A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
19
votes
10answers
1k views

Is it ever appropriate to fight back?

When an website or system is being attacked, is there ever a scenario where it should automatically take action against the attackers rather than just passively handling the attack? If so, what ...