Hacker News Reader

Comment by RyanZAG | Hacker News Reader

Well.. you didn't read the first couple lines? Notably:

> I’ve notified both Yahoo! and the FBI New Orleans field office of the infiltration, but in my eyes, they really aren’t seeing the severity and danger of this situation, and really are not reacting quick enough.

> This document is being released due to several high profile companies being infiltrated using the recent Shellshock vulnerability, and what I have deemed as an improper response, or lack thereof ...

Seems pretty straight forward: hackers have already downloaded all the personal data out of these organizations and are probably using it in ways harmful to the general public already. This guy is forgoing his probable bug bounty payouts as this is, as he says, a really serious issue.

Thank you to him!

View on HN

> I’ve notified both Yahoo! and the FBI New Orleans field office of the infiltration

And the feds are standing at his front door in 3 .. 2 .. 1.

Looks like you only read the first couple lines. What I'm referring to:

> I’ve also emailed Marissa Mayer and contacted her via twitter, both of which yielded zero results and no response. There are no publicly available contact methods for Yahoo! that have yielded any luck with trying to contact them regarding this.

I think the "that have yielded any luck" part of that quote is pretty important.

The point I'm making is that he didn't do the obvious thing and search for their actual security report address which they have, respond to, and pay people money who report bugs to. He found the hacked servers by doing a search but couldn't do this?

Pretty sure that if he's actually talking with Yahoo and the FBI then someone would have pointed him to that address if he really hadn't found it himself! More likely, they just told him "hang on, we'll look into this.. eventually" and he felt this was important enough that a delay like that is unacceptable. Which it is. If you know you've just lost all your customers data, you don't wait a few days to tell them - you schedule a press release for same day release.

I don't see how you're reaching this conclusion. He said, there are no publicly available contact methods that have "yielded any luck". He didn't say there are no publicly available contact methods or that he didn't e-mail yahoo's "security" e-mail address.

I'm reaching this conclusion because the only person he mentions emailing is Yahoo's CEO.

> that have yielded any luck with trying to contact them regarding this

Might be the important part of the quote you missed.

He didn't email the right address and didn't bother to look for it. Yahoo, like google and facebook, has a large security department but if you send your report to support@yahoo.com and not security@yahoo.com and don't get a response you don't get to say Yahoo is lax in security because you didn't take a second to google for the right address.

Dude your screen name is really telling.

He reached out, and didn't have any luck. Companies truly need to learn how to deal with these breaches in a way that re-invites the public trust

You seem to be missing my point. I've repeated it in a bunch of other comments but I'll do it again here: You don't get points for "reaching out" when you don't spend a second to search for the right address to reach out to. Yahoo has a page dedicated to reporting bugs. If he had used that page he would have gotten a response. Yahoo has paid dozens of people for doing this https://hackerone.com/yahoo?show_all=true.

I'm not quite sure why you seem so sure he didn't also send an email to that address (or use that form)? I didn't read the article thoroughly, did he enumerate somewhere which ways of contacting Y! he tried?

if he had sent it to the other address, why would the person who responded pointed it out as the email to contact? If he had already sent an email to the Yahoo Security contact, why would he then be told to do the same thing twice?

Reply on news.ycombinator.com