full-disclosure - Re: Knorr.de SQL Injection and XSS Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.58.0703021540330.28318@dione>
Date: Fri, 2 Mar 2007 15:56:09 +0100 (CET)
From: Michal Zalewski <lcamtuf@...ne.ids.pl>
To: "sbauer@...-network.net" <sbauer@...-network.net>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Knorr.de SQL Injection and XSS Vulnerabilities

> Significance: Very Critical

I'm very pro-disclosure. I do see a point in disclosing flaws in software
or hardware we might use.  I do see a point in reporting flaws in websites
we rely on (banks, online shops). Hey, there might even be a weak case for
shaming security vendors, IT companies, or fellow professionals by
exposing flaws on their sites; it's mean, but it may have some value.

But I'm puzzled at to what's the point in telling the world about a
generic flaw in soup-maker's website, where - really - the number of
people even marginally affected is truly negligible?

Talk to them, tell them, have it fixed; if they're nice, they might even
give you a gift or some sort (year's worth of instant noodles, I'm
thinking). Blog it if you find it important to tell others about your
achievement, but really, that's where it should end.

/mz

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/