5 ms·

Hmm, did you just post this "disclosure" on your blog before informing the company? Well, now everyone is at risk if your claims are true. Poor form. Proper co

Hmm, did you just post this "disclosure" on your blog before informing the company? Well, now everyone is at risk if your claims are true. Poor form. Proper course is to disclose to company first, then disclose after fix is in place in reasonable amount of time. Why risk everyone for your benefit?

TacticalCoder 13y ago
TFA states precisely this: "In the interest of responsible disclosure I did try and contact the dev multiple ways, I was either ignored or not replied to and I feel users deserve to know what’s happening with their data."
akerl_ 13y ago
"In the interest of responsible disclosure I did try and contact the dev multiple ways, I was either ignored or not replied to and I feel users deserve to know what’s happening with their data."
LCoder 13y ago
At the bottom of the post it does state: In the interest of responsible disclosure I did try and contact the dev multiple ways, I was either ignored or not replied to and I feel users deserve to know what’s happening with their data.
nknighthb 13y ago
Puffchat put people at risk.
MichaelGG 13y ago
Everyone was already at risk, but they didn't know it. They were already downloading this content to devices everywhere. He also says that he tried to contact the developer but got no response. The dev would have been much better off apologizing, pushing a fix, and asking for a temporary embargo while the fix is put into place.
alcari 13y ago
FTA: "In the interest of responsible disclosure I did try and contact the dev multiple ways, I was either ignored or not replied to and I feel users deserve to know what’s happening with their data."
zorpner 13y ago
As you can read in the article, he did try to contact the developer. That aside, though, when the issues are this egregious I'm honestly not sure what the right approach is. With flaws this bad it's hard to imagine that they're even capable of fixing the problems, let alone responding appropriately to the disclosure.
- hrrsn 13y ago
  They seem like really easy problems to fix, too.
rdl 13y ago
Fuck "Responsible Disclosure" in cases of utter incompetence like this.

TacticalCoder 13y ago

TFA states precisely this: "In the interest of responsible disclosure I did try and contact the dev multiple ways, I was either ignored or not replied to and I feel users deserve to know what’s happening with their data."

akerl_ 13y ago

"In the interest of responsible disclosure I did try and contact the dev multiple ways, I was either ignored or not replied to and I feel users deserve to know what’s happening with their data."

LCoder 13y ago

At the bottom of the post it does state: In the interest of responsible disclosure I did try and contact the dev multiple ways, I was either ignored or not replied to and I feel users deserve to know what’s happening with their data.

nknighthb 13y ago

Puffchat put people at risk.

MichaelGG 13y ago

Everyone was already at risk, but they didn't know it. They were already downloading this content to devices everywhere. He also says that he tried to contact the developer but got no response. The dev would have been much better off apologizing, pushing a fix, and asking for a temporary embargo while the fix is put into place.

alcari 13y ago

FTA: "In the interest of responsible disclosure I did try and contact the dev multiple ways, I was either ignored or not replied to and I feel users deserve to know what’s happening with their data."

zorpner 13y ago

As you can read in the article, he did try to contact the developer. That aside, though, when the issues are this egregious I'm honestly not sure what the right approach is. With flaws this bad it's hard to imagine that they're even capable of fixing the problems, let alone responding appropriately to the disclosure.

hrrsn 13y ago
They seem like really easy problems to fix, too.

rdl 13y ago

Fuck "Responsible Disclosure" in cases of utter incompetence like this.