Timeline for Best way to alert a website owner of a vulnerability?
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 9, 2012 at 19:21 | comment | added | Taipo | In a perfect world that is how things should work. However history is full of examples where developers have left bugs on the todo list indefinitely due to a cocktail of arrogance, laziness, ignorance and mediocrity. Out of frustration mostly, bug finders have turned to public releases (0days) as a means of last resort. This has lead to a common method which at times is not the best method when dealing with these issues. So in the end it is not a matter of what we think is the best way, it is an unavoidable reality. However we are both saying which is the best way. | |
| Feb 9, 2012 at 15:54 | comment | added | dr jimbob | My thought process is that its never good to publicly disclose vulnerabilities that can't be avoided by end-users. E.g., a public disclosure re exploits in firefox 3.5.0 JIT javascript compiler made sense; users can upgrade to a patched version or disable the JIT via a setting. But disclosing that one custom-designed website has vulnerabilities to SQL injection leaves the public no options (can't reconfigure their server) to fix and many services don't let you fully remove your data from them. | |
| Feb 7, 2012 at 23:40 | comment | added | Taipo | It wasn't advice. It was simply noting the common practice whether we like it or not. One can ignore this common practice or notate it. My advice is the courteous approach in the preceding paragraph. | |
| Feb 7, 2012 at 15:13 | comment | added | dr jimbob |
I agree the web maintainers/developers usually want to know about vulnerabilities. However, its not clear that the devs were contacted; esp if developed externally--it may take a while for the communication to get to the appropriate parties (who may not want to admit their incompetence to customers). However, -1 for suggesting posting it publicly as 0day exploit--that's dangerous advice which will increases the risk that black hats steal existing private user data and That Guy is held liable.
|
|
| Feb 7, 2012 at 8:34 | history | answered | Taipo | CC BY-SA 3.0 |