News for hackers. Stuff that matters.

A comment on Anyone can access deleted and private repository data on GitHub. Parent comment

Re:Anyone can access deleted and private repository data on ... by cyrnel on Wednesday July 24, 2024 @04:19PM (#41061569)
Security disclosures are like giving someone an unsolicited gift. The receiver is obligated to return the favor.

But if you buy someone non-refundable tickets to a concert they already have tickets for, you aren't owed compensation.

[ Parent | on HN ]
Re:Anyone can access deleted and private repository data on ... by TheDong on Wednesday July 24, 2024 @07:33PM (#41063342)
Security disclosures are like telling someone they have a spot on their face. It's not always welcome, and there's no obligation on anyone to do so, nor anyone to return the favor.

In this case, the spot turned out to be a freckle, which everyone involved already knew was a freckle (since it was documented), and if anyone owes anyone anything, it's the researcher that owes github for wasting their time.

[ Parent | on HN ]
Re:Anyone can access deleted and private repository data on ... by account42 on Thursday July 25, 2024 @05:40AM (#41066674)
> Security disclosures are like giving someone an unsolicited gift.

Exactly.

> The receiver is obligated to return the favor.

Not at all. This is a very toxic expectation.

[ Parent | on HN ]