The branch of philosophy which deals with how the professionals should make decisions regarding professional and social conduct

learn more… | top users | synonyms

33
votes
6answers
2k views

How to disclose a security vulnerability in an ethical fashion?

How to disclose a security vulnerability in an ethical way? I've heard there are various schools of thought on this topic. I'd like to know the pros/cons of each.
10
votes
3answers
532 views

Reporting vulnerable sites

Take this scenario: You browse the web and find a website that is vulnerable to SQL Injection. Being a good guy/gal you report the vulnerability to the site owner (if you are able to find contact ...
17
votes
2answers
597 views

How to handle security issues of someone else's website

A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
48
votes
4answers
5k views

I think I accidentally DoS'd a website. What should I do?

I was browsing a website, and stumbled across a sample scheme for password-protecting web pages. The owner of the website specifically had a page that invited people to attempt to hack it. I wanted ...
12
votes
2answers
832 views

What are legal/ethical concerns to bear in mind, when hacking websites with open invitations?

I was reading another question which mentions a site that had a page inviting people to try to hack it, and it made me wonder. Lets assume, for the sake of this rather hypothetical question, that a ...
7
votes
4answers
434 views

How should I escalate a vulnerability that is dismissed by the vendor?

I've come across a vulnerability that secure@microsoft does not think is worth pursuing. I would estimate that there are many, many customers affected by this issue. I do not want to start a ...
3
votes
5answers
400 views

Was the ASP.NET Padding Oracle exploit exposed in an ethical manner? What could have been done differently?

This is a multi-part question.... In regards to the ASP.NET Padding Oracle, (demo link)was that security exploit dealt with in an ethical manner? What could have been done differently or better? ...
6
votes
5answers
2k views

Penetration testing by ethical Hackers/Crackers should be trusted?

My question today come from my homework question from class ethics in IT. Our question states roughly that I'm IT guy in in big company and I am asked to hire few hackers to to find vulnerabilities ...
5
votes
2answers
308 views

Ethics and economy in security research

How can we design a market for information disclosure where individual security researchers may benefit economically in an ethical way? Assume a market where the participants are governments, ...
2
votes
1answer
559 views

Found huge bug, what should I do? [duplicate]

Possible Duplicate: How to disclose a security vulnerability in an ethical fashion? Reporting vulnerable sites I've found a huge bug which gives me the possibility to get (through ...
2
votes
1answer
136 views

What is a good method to report security breaches that are being used to actively spam?

I received an email the other day purporting to be from a bank I hadn't even heard of, so I decided to poke around. On some quick investigation, it looks like something has just latched onto some poor ...