this post was submitted on 06 Jul 2023
65 points (97.1% liked)
Cybersecurity
5754 readers
170 users here now
c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
- Be respectful. Everyone should feel welcome here.
- No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
- No Ads / Spamming.
- No pornography.
Community Rules
- Idk, keep it semi-professional?
- Nothing illegal. We're all ethical here.
- Rules will be added/redefined as necessary.
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
Notable mention to [email protected]
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
It’s common courtesy to try and contact the developer before making something like this public.
OP doesn't seem interested in that. They state they "sent a vulnerability a week ago" and didn't hear back so they are being completely irresponsible and posting about it publicly on a community instead.
OP is just quoting me there I think. If they aren't quoting me then they did try to contact the developer...
Typical reasonable disclosure is in terms months usually, not "nearly a week". OP is being irresponsible at best by posting this before giving time to the developers to see, and act on it.
I mean, a dialogue over months, maybe. Over a week of hearing nothing even saying they got your email and are looking into it is pretty bad on the part of the lemmy devs IMO. The "responsibility" part of responsible disclosure goes both ways. Also, this is incredibly low effort to find. This isn't even XSS really, it's just a complete lack of link filtering.
It absolutely does, it also means following up, not "They didn't reply in a week so instead of trying other ways to contact them, I'm just going to post about it". They didn't even try to open an issue because they "don't use github" all while coming here talking about how bad the vulnerability is.
It's poor (lack of) judgement on OP's part.
It's not great from either side here, really. Precise guidelines for responsible disclosure vary, but none would ever say "go public after trying to contact the developers once and not hearing back for a week".
ZDI's policy says that after 5 days they attempt contact again. After another 5 days, they'll try any intermediaries or other ways of contacting they can think of up until 15 days after the initial contact. If at any point before that, the developers acknowledge the problem, ZDI gives up to 120 days to resolve the problem (from date of acknowledgement). They imply (without having a specific policy laid out) that more time will be given beyond that if it's reasonably needed.
All of OP's comments have been deleted so I don't know what they tried exactly, but it certainly seems like they didn't try hard enough. It also seems like Lemmy's devs may not have been responsive enough. Ideally, they would have a
/.well-known/security.txtfile with an email address that is actively monitored explicitly for security disclosures. Failing that, whatever public method they do have for contact that OP used, assuming it was a mode of communication that could reasonably be expected to be monitored, should have been monitored.I actually don't think that GitHub is an appropriate place to be doing security vulnerability disclosures. GitHub might not be user-facing, but it's still public. You can maybe put something in there essentially as a way to tag "hey, be on the lookout for a real disclosure", but any actual details should not be on GitHub. In this case, if the email didn't work, OP should have posted something on GitHub saying "hey, major security flaw, please check your email for details". If OP really doesn't want to use GitHub, they should have requested someone else do that on their behalf—maybe via a sufficiently vague post on Lemmy. What's absolutely clear that they should not have done, is gone public with all the details based on a single attempt at emailing and one week of waiting.