Hacker News Reader

Comment by athrowaway3z | Hacker News Reader

I think something has gone very wrong for you to be doubting the answer.

Responsible disclosure is to prevent harm. You think about your disclosure options and pick the one that is best overall weighing the impact and harm.

They're already infected - or so you claim.

I get that companies want to use responsible disclosure as a mechanism so it can save face and their reputation, and if both are possible at the same time then sure.

But if you think you're right, you have to pick one and live with the consequences; and its not that hard to pick the right choice.

In fact, if you don't make the right choice you need stop misusing the word “responsible disclosure”.

Publish the URLs that prove they're infected. Auto update it whenever one get's fixed.

View on HN

> companies want to use responsible disclosure as a mechanism so it can save face and their reputation

That sounds like the opposite of the goal of that procedure, since the point is the disclosure. Telling everyone about a weakness before it can be solved would harm users, that's why you coordinate with the vendor, but disclosure and resolution is the goal you're working towards. Saving face would be a gag order or agreement, which many companies indeed have tried, but that's the opposite of companies that publish their procedure for coordinated vulnerability disclosure (also/formerly called responsible disclosure) so that white-hats can report issues without fearing legal action. That also means that these companies have to own up to it once the issue is resolved, or at least the hacker is free to talk about it

The rest of your comment is right though: for sites that are already infected, being quiet about it doesn't prevent a vulnerability from being exploited anymore

It’s not a notice of a vulnerability. For all they know it was an employee abusing access. You don’t leave a skimmer on a pump and politely keep sending emails to corporate waiting for a response. You call the cops and they should shut the pumps off until the skimmers are removed. With the amount of AI security report slop and AI extortion spam out there this is basically a service that only the web host can provide.

This seems correct? If true, they are currently dangerous to others and they should be called out for it. Why will people be more proactive here if they can just hide their mistakes?

How do you responsibly disclose to 15 thousand websites?

You don't (well not unless you want to run a mass email campaign that is indistinguishable from spam)

Reply on news.ycombinator.com