Security hole found in Rails 2.3's http_authentication.rb

Re:Security hole found in Rails 2.3's http_authentication.rb by jf on Wednesday June 03, 2009 @05:38PM (#640482)

Where should the security contact information be?

If you found a flaw on site example.com, where would you look first for a security contact?

[ Parent | on HN ]

Re:Security hole found in Rails 2.3's http_authentication.rb by tptacek on Wednesday June 03, 2009 @07:40PM (#640681)

/security, security@, the "security" tab on the front page.

[ Parent | on HN ]

Re:Security hole found in Rails 2.3's http_authentication.rb by petercooper on Thursday June 04, 2009 @05:18AM (#641150)

Depends on the protocol the security flaw is with, but RFC 2142 would indicate that if it's a Web issue, then [email protected] - sadly people don't pay attention to many standards like this anymore, though, because they'd rather the Internet be broken.

[ Parent | on HN ]

Re:Security hole found in Rails 2.3's http_authentication.rb by tptacek on Thursday June 04, 2009 @05:40PM (#642304)

A weird comment, since this isn't a web issue, it's an issue with a software library.

[ Parent | on HN ]

Re:Security hole found in Rails 2.3's http_authentication.rb by pmjordan on Wednesday June 03, 2009 @07:16PM (#640661)

Probably "feedback", "contact us", and "support", roughly in that order.

[ Parent | on HN ]