News for hackers. Stuff that matters.

A comment on Tell HN: Forwarded Facebook emails automatically login as recipient. Parent comment

Re:Tell HN: Forwarded Facebook emails automatically login as... by khazhou on Monday October 08, 2018 @11:21PM (#18173076)
I will kindly suggest that in the future, instead of phrasing advice in the form of "Any particular reason you didn't do the thing which to me is obviously the only smart thing to do?", you could give feedback more prescriptively and without any implied accusations.

For example:

"peteforde, in the future please do the following instead of posting on HN:

- Google "how to report security issues to <whatever company>"

- In this case, you will be directed to facebook.com/whitehat

- You should try to reproduce this independently first, after reading the best practices for doing so at the URL above.

And, there may be a five-figure sum for you if you indeed find a vulnerability, and report it as above."

[ Parent | on HN ]
Re:Tell HN: Forwarded Facebook emails automatically login as... by eganist on Monday October 08, 2018 @11:23PM (#18173087)
Your guidance has been noted and is appreciated.

I'm leaving my initial post unedited not only for context but because I feel it conveys a certain gravity as to the discoverability of the best practice that was missed here. I'm generally a fan of the feedback pattern you described... but not always. Egregious impermissible disclosures of any sort--security, PHI/PCI/PII/FERPA, etc. all fall in the "not always" bucket for me.

[ Parent | on HN ]
Re:Tell HN: Forwarded Facebook emails automatically login as... by insickness on Tuesday October 09, 2018 @06:01AM (#18174578)
To me the wording, "Any particular reason you didn't do x?" wasn't an implied accusation. In fact it was the opposite. It was assumed that the original poster had taken all measures and had a good reason why they didn't take the action. It is similar to saying, "Have you considered...?" It is a less combative way to say, "You should have done x," which does implied that the original poster did something wrong.
[ Parent | on HN ]