Hey @attritionorg - good article. You nicely convey the difficulties of disclosure methods and the tensions between company & white/grey hat
-
-
-
@CreetureNZ Appreciate it! -
@attritionorg np. Have been reading the Dutch Responsible Disclosure policy so your piece made for sum good reflection -
@CreetureNZ haven't read that policy, link please? (cc@OSVDB) -
@attritionorg will track down for u once home (am on train at mo) -
@CreetureNZ excellent, appreciate it -
@attritionorg you can download the english version here: https://www.ncsc.nl/english/current-topics/news/responsible-disclosure-guideline.html …#disclosure -
@CreetureNZ Interesting document, thanks.
End of conversation
New conversation -
-
-
@attritionorg if you find a vuln and maliciously exploit it to post the results online to do damage, you end up with another set. -
@zate unconfirmed, but apparently you may have to pay $99 a year to be part of the network that allows you to report bugs to AT&T -
@attritionorg i agree that on the surface at most basic find vuln, get 41 months is bad. .. how ever its not that simple. -
@zate it isn't that simple, but for all the wrong reasons. -
@attritionorg certainly puts bug bounty programs in strange place.. do you chance it for the money?
End of conversation
New conversation -
-
-
@attritionorg if you find a vuln, disclose and report it appropriately you end up with one set of consequences. -
@zate no, you do not. sometimes you end up with a fixed vuln. sometimes you end up with vulnerable customers for 5+ years.
End of conversation
New conversation -
-
-
@attritionorg i think there is a difference between finding a vuln and exploiting a vuln for $/lulz/what ever. attitude is important. -
@zate attitude is, but ultimately, what is the real damage done? especially as compared to the other cases cited.
End of conversation
New conversation -
-
-
@attritionorg I agree, except the Steubenville rapists are minors. I think that should be noted. It's not apple-apples. -
@wikidsystems This whole "18" thing is an arbitrary line for defining a minor in today's society. What teenager thinks rape is OK? -
@attritionorg to me the problem with the law is that the required minimum sentences eliminate judicial discretion.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.