mailing list archives
Re: Knorr.de SQL Injection and XSS Vulnerabilities
From: Michal Zalewski <lcamtuf () dione ids pl>
Date: Fri, 2 Mar 2007 15:56:09 +0100 (CET)
Significance: Very Critical
I'm very pro-disclosure. I do see a point in disclosing flaws in software
or hardware we might use. I do see a point in reporting flaws in websites
we rely on (banks, online shops). Hey, there might even be a weak case for
shaming security vendors, IT companies, or fellow professionals by
exposing flaws on their sites; it's mean, but it may have some value.
But I'm puzzled at to what's the point in telling the world about a
generic flaw in soup-maker's website, where - really - the number of
people even marginally affected is truly negligible?
Talk to them, tell them, have it fixed; if they're nice, they might even
give you a gift or some sort (year's worth of instant noodles, I'm
thinking). Blog it if you find it important to tell others about your
achievement, but really, that's where it should end.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/