You are on the mercy of the guy who found the vulnerability, if you like it or not. This person can have any personality and most of them don't care about your costs. They did your work and invested a lot of time. Most of then don't want money, they want appreciation for what they did. You can give it to them, or they take it and they have the perfect tool for that.

Entirely true. And that person is at the mercy of their governing law and the company's ability to pursue and press charges should they decide to take matters into their own hands, regardless of intent (unless their governing law takes intent into account).

Has he been arrested yet? If not, I wonder why not. Github should press charges.

There's a big difference between acknowledging that a crime can be committed, and condoning that crime when it happens.

> If it's a concern, get a hold of the company and let them know.

Easier said than done. It's hard enough to find the right people to talk to when people are so paranoid about connecting devs with customers, and if by chance you wind up talking to a PM first, the first thing he does is engage legal, which means instead of fixing the problem and protecting their customers and data, you may now be threatened with lawsuits, have the incident reported to the FBI or someone for investigation (on the assumption that you are in fact trying to extort them or something).

In this world, I'm not sure you can 'win' at this situation at present. Until there are protections for white hats that are broadly recognized, I'm going to side with people like Egor, who find a big damn problem and don't use it for ill.

That's a very good point about there not necessarily being a right answer. Though of all the companies in the world, Github is one of the easiest to get in touch with their developers.

And yet Egor made several attempts to illustrate the depth of a single problem, and nobody was able to understand that this was serious badness.

Sometimes, it is actually necessary to pull down someone else's pants to expose a problem. I think the record here speaks for itself.

Maybe you do need to sometimes pull down someone else's pants to expose a problem. I think that's a moot point because nobody should really be able to disagree with that on pure logic. I think the important question is when someone feels they have no other choice, so they pull down the person's pants, should this be considered an immoral or criminal act? The guy can always say, "Look, I never intended to do any harm, I just wanted to get people's attention to fix this before someone who was intending to do harm came along." The problem is then how do you prove that they really were so benign? I think it'd be easy for a lot of blackhats to hide behind that if they ever got caught, or no? Even if there was complete immunity for people who immediately came out in the open and claimed responsibility for the sake of clearing the air, it'd still be easy for blackhats to hide their rationales in there, while they did something else more malicious (and then if that malicious thing was ever found, the blackhat can easily say, "Hey, I told you guys to fix it!! Now look what happened!! Wasn't me though!".

Maybe I missed something, but from looking through his posts, it seems that Egor felt the defaults in Rails were insecure (let's face it, they are), and then when he didn't get the immediate feedback from the rails team that he had hoped for, he decided to illustrate his point by hacking Github, which happens to be built on Rails. Nowhere did I read, on his own blog or within any of the rails issue tickets, that he actually tried reaching out to Github (i.e. contacting [email protected]) before exploiting the vulnerability.

Maybe he did try to contact Github first, but I didn't see anything mentioning that in any of the linked posts.

The immediate feedback was multiple issues closed as if they were not serious.

In Germany we have the CCC, they provide legal advice for these cases and have a ton of experience.

Do you have something similar in the states?

EFF has a network of people they can put people in touch with, even if for a variety of reasons they can't offer legal help in a particular instance.

But that's not the point. While we can be grateful for the CCC and the EFF for existing and doing the community a great service, we can also believe that their extraordinary contributions should be unnecessary.