How to pwn a billion dollar VC firm using inspect element

Re:How to pwn a billion dollar VC firm using inspect element by nlh on Saturday July 20, 2024 @12:32PM (#41017669)

I understand where you're coming from, but you're using "should" a lot. Companies should do a lot of things! They should make their sites secure. They should have a formal bug bounty program. They should have security@ and engineering@ and lots of other emails easily visible. We agree.

But many don't. And a lot of things in the business world are not as they should be. And in this real world of imperfection, others sometimes need to put in effort (and be paid for that effort) to make up for the failings of companies. This is one of those cases of imperfection.

[ Parent | on HN ]

Re:How to pwn a billion dollar VC firm using inspect element by mynameisvlad on Saturday July 20, 2024 @12:35PM (#41017691)

Of course I’m using “should” a lot. Because “should” clearly didn’t happen.

That doesn’t change anything. Just because a company has shitty security reporting practices doesn’t suddenly mean the onus is on the researcher to do the company’s job.

[ Parent | on HN ]