Hacker News Reader

Comment by mgkimsal | Hacker News Reader

Perhaps with some formalized amnesty? If I go to the trouble of contacting you to tell you you've got a security problem, do not threaten to call the police or FBI on me. I've had that happen once, and I've tended to stay away from contacting places even when I saw they had a clear security violation, because

a) I'm not sure how they'll react (will they claim I'm trying to extort them?)

b) there's never any clear way to contact a company beyond calling/emailing 'customer support'.

Occasionally I've tried to poke around my linkedin network to see if I had a connection at company X to reach out to their dev team and notify them of something, but I've never been successful that way (but also haven't pushed the issue much).

View on HN

I think the best solution would be for more companies to publish a page on their website telling people what to do if they find a security problem, like GitHub and 37signals do (Google and Facebook also offer a bounty).

I guess a problem with this is stating where the line is drawn. It might be difficult to promise not to sue well-intentioned researchers without reducing their ability to sue people with malicious intentions.

Companies that have security pages and contact details are also companies that understand the importance of security issues. the problem here is that most companies do not understand the issue and tend to react defensively

One solution might be using an agent - setup a clearing house for security issues run by a couple of trusted people. You log the issue, the clearing house gets in touch with the company and gives them access to the issue details.

It keeps the person reporting the issue one step away from the company and any potential trouble.

Once the company acknowledges and fixes the issue it is made public with an optional credit

If they don't acknowledge the issue it becomes public anyway after x days.

What stops them checking their logs to find your IP?

hiding your real ISP IP isn't that big a deal for pen testers, either VPN or Tor

I don't know many (I certainly don't) who use their real IP when probing sites

Yup and with an auto-responder which states their policy + PGP keys.

oooh - good idea.

Even sometimes working inside a company when you see bad security, you can't do anything about it - I made another post about this separately.

Reply on news.ycombinator.com