The branch of philosophy which deals with how the professionals should make decisions regarding professional and social conduct
24
votes
6answers
879 views
How to disclose a security vulnerability in an ethical fashion?
How to disclose a security vulnerability in an ethical way? I've heard there are various schools of thought on this topic. I'd like to know the pros/cons of each.
9
votes
3answers
279 views
Reporting vulnerable sites
Take this scenario:
You browse the web and find a website that is vulnerable to SQL Injection. Being a good guy/gal you report the vulnerability to the site owner (if you are able to find contact ...
40
votes
4answers
3k views
I think I accidentally DoS'd a website. What should I do?
I was browsing a website, and stumbled across a sample scheme for password-protecting web pages. The owner of the website specifically had a page that invited people to attempt to hack it.
I wanted ...
17
votes
2answers
431 views
How to handle security issues of someone else's website
A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
7
votes
4answers
346 views
How should I escalate a vulnerability that is dismissed by the vendor?
I've come across a vulnerability that secure@microsoft does not think is worth pursuing.
I would estimate that there are many, many customers affected by this issue.
I do not want to start a ...
10
votes
2answers
493 views
What are legal/ethical concerns to bear in mind, when hacking websites with open invitations?
I was reading another question which mentions a site that had a page inviting people to try to hack it, and it made me wonder.
Lets assume, for the sake of this rather hypothetical question, that a ...
3
votes
5answers
318 views
Was the ASP.NET Padding Oracle exploit exposed in an ethical manner? What could have been done differently?
This is a multi-part question....
In regards to the ASP.NET Padding Oracle, (demo link)was that security exploit dealt with in an ethical manner? What could have been done differently or better?
...
6
votes
2answers
248 views
Ethics and economy in security research
How can we design a market for information disclosure where individual security researchers may benefit economically in an ethical way?
Assume a market where the participants are governments, ...
5
votes
5answers
1k views
Penetration testing by ethical Hackers/Crackers should be trusted?
My question today come from my homework question from class ethics in IT.
Our question states roughly that I'm IT guy in in big company and I am asked to hire few hackers to to find vulnerabilities ...
1
vote
1answer
361 views
Found huge bug, what should I do? [duplicate]
Possible Duplicate:
How to disclose a security vulnerability in an ethical fashion?
Reporting vulnerable sites
I've found a huge bug which gives me the possibility to get (through ...
2
votes
1answer
106 views
What is a good method to report security breaches that are being used to actively spam?
I received an email the other day purporting to be from a bank I hadn't even heard of, so I decided to poke around. On some quick investigation, it looks like something has just latched onto some poor ...
