Re:Security issues on ArtChain
by pavel_lishin on Tuesday November 06, 2018 @03:06PM
(#18394452)
I disagree that the best outcome is full immediate public disclosure. N (where N may be 0) bad actors abusing the vulnerability is not necessarily worse than releasing the vulnerability to where any script kiddie can abuse it.
A direct example is right here - ArtChain is now completely unusable because someone decided it would be funny to redirect their homepage to Pornhub. Sure, they had it coming, but I'd wager at least a few readers here had to hurried explain to a coworker why they were looking at porn at work.
(Granted, it's not a good example, because the researcher in question did reach out, and the incompetent idiot showed his ass to the entire internet, but immediate full disclosure would have had the same effect.)
I also agree that just sitting on the vuln and pleading with an idiot is not a productive use of anyone's time.
Re:Security issues on ArtChain
by lvh on Wednesday November 07, 2018 @11:24AM
(#18400149)
ArtChain had that bug, it was trivially discoverable with automated scanners, someone told them about it, and they did _worse_ than ignoring the report -- so yes, I agree, your example is really more of a counterexample :-D
A direct example is right here - ArtChain is now completely unusable because someone decided it would be funny to redirect their homepage to Pornhub. Sure, they had it coming, but I'd wager at least a few readers here had to hurried explain to a coworker why they were looking at porn at work.
(Granted, it's not a good example, because the researcher in question did reach out, and the incompetent idiot showed his ass to the entire internet, but immediate full disclosure would have had the same effect.)
I also agree that just sitting on the vuln and pleading with an idiot is not a productive use of anyone's time.