News for hackers. Stuff that matters.
Re:How I recorded user behaviour on my competitor’s websites by rapind on Thursday August 23, 2018 @10:21AM (#17827464)
This is the misconception I can't stand. Where we hold individuals responsible for a product / companies defect. I thoroughly disagree with the idea that it's his fault people are vulnerable.

So called responsible disclosure is just a marketing spin term. Disclosing bugs privately is a favour not a responsibility. All this does is reduce the risk of bad software decisions. It doesn't solve anything.

How about free market instead? If you run a multi-billion dollar company that can be hurt by issues like this, then it's on you to make it more profitable to disclose issues privately. If you can't or refuse to do that, then you're exposing your company and your customers to risk. Enough with the shunning and the "responsibility" of individuals which expose bugs.

Re:How I recorded user behaviour on my competitor’s websites by EGreg on Thursday August 23, 2018 @01:49PM (#17829242)
I sympathize with THIS position. It’s the same blame shifting crap when “identity theft” becomes your fault, even though any cashier or clerk can “steal your identity”.

What this marketing spin does is give cover to those who design badly secured systems.

http://www.youtube.com/watch?v=CS9ptA3Ya9E

Also similar is the “jaywalking” idea, made by car manufacturers to make the default right of way to cars!

http://amp.charlotteobserver.com/opinion/op-ed/article650322...

[dead]
Re:How I recorded user behaviour on my competitor’s websites by dejanseo on Thursday August 23, 2018 @10:34AM (#17827589)
Google? When I brought a serious issue up in 2012 https://dejanseo.com.au/hijack/ Google never fixed it:

In summary, I can take any of your (or anyone else's content) pass more pagerank to it than the original page and then I become the original page. Not only that but all your inbound links now count towards my site and I can see your links in Search Console of my domain.

This is something link graph theory refers to as "link inversion" and is very harmful to smaller publishers.

Re:How I recorded user behaviour on my competitor’s websites by _bxg1 on Thursday August 23, 2018 @10:37AM (#17827615)
I can't speak to that particular exploit, but no matter what you always go to the vendor privately first. Period. If they are uncooperative you can then go public. Not before.
Re:How I recorded user behaviour on my competitor’s websites by rapind on Thursday August 23, 2018 @10:51AM (#17827721)
I'm not sure how to respond to your comment (for the record I didn't downvote you). The free market point was obvious to me, but I'll elaborate.

When he chose to expose this bug, either he wasn't aware of an alternative (so called responsible private disclosure) or that alternative just wasn't appealing enough. Since we're dealing with a company that generates income (indirectly) through the product, they risk financial consequences from this sort of exposure. It follows that doing more to incentivize and generate awareness of their disclosure policy would reduce their risk which would have a financial impact. It's up to them to decide how much to money / effort / resources to spend on reducing that risk.

My stance is that public shunning doesn't solve the problem of releasing buggy software. I'm actually a Google fanboy, but (to me) they could do better. Instead we get "The site is completely removed from their index without any notification." Maybe we need to elevate browser security to the level of Space Shuttle safety? Obviously that costs more and takes longer, slowing innovation, but IMO the market should determine that.

TLDR; The idea that the individual is responsible for exposing a companies bugs is completely absurd to me. I'll respect you having a different opinion on it.

Re:How I recorded user behaviour on my competitor’s websites by sctb on Thursday August 23, 2018 @02:11PM (#17829417)
Please don't do this.

https://news.ycombinator.com/newsguidelines.html (see "idiotic")