Re:Show HN: I made a tool that turns screenshots into dramat...
by d-z-m on Friday February 10, 2023 @08:10AM
(#34739183)
> Arguably a lot of things are not strongly protected per se but rely on specialists not trying to actively trick the system
If a system has a vulnerability, it is the system's fault, not the specialist's. I'm a bit sensitive to this line of argument because it and arguments like it have been used in the past to try and demonize the efforts of security researchers. However, I also believe we should have good norms around responsible disclosure.
> much less posting their techniques on public forums.
Perhaps it could've been more responsibly disclosed to the OP, agreed. However, the public internet is a public forum. OP posted his code there, and it was found. Any number of web crawlers have probably already found it. Not the least painful way to learn this lesson, but hopefully it was learned.
If a system has a vulnerability, it is the system's fault, not the specialist's. I'm a bit sensitive to this line of argument because it and arguments like it have been used in the past to try and demonize the efforts of security researchers. However, I also believe we should have good norms around responsible disclosure.
> much less posting their techniques on public forums.
Perhaps it could've been more responsibly disclosed to the OP, agreed. However, the public internet is a public forum. OP posted his code there, and it was found. Any number of web crawlers have probably already found it. Not the least painful way to learn this lesson, but hopefully it was learned.