Full Disclosure mailing list archives
Re: Knorr.de SQL Injection and XSS Vulnerabilities
From: Michal Zalewski <lcamtuf () dione ids pl>
Date: Fri, 2 Mar 2007 15:56:09 +0100 (CET)
Significance: Very Critical
I'm very pro-disclosure. I do see a point in disclosing flaws in software or hardware we might use. I do see a point in reporting flaws in websites we rely on (banks, online shops). Hey, there might even be a weak case for shaming security vendors, IT companies, or fellow professionals by exposing flaws on their sites; it's mean, but it may have some value. But I'm puzzled at to what's the point in telling the world about a generic flaw in soup-maker's website, where - really - the number of people even marginally affected is truly negligible? Talk to them, tell them, have it fixed; if they're nice, they might even give you a gift or some sort (year's worth of instant noodles, I'm thinking). Blog it if you find it important to tell others about your achievement, but really, that's where it should end. /mz _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Knorr.de SQL Injection and XSS Vulnerabilities sbauer (Mar 02)
- Re: Knorr.de SQL Injection and XSS Vulnerabilities Knud Erik Højgaard (Mar 02)
- Re: Knorr.de SQL Injection and XSS Vulnerabilities Sebastian Bauer (Mar 02)
- Re: Knorr.de SQL Injection and XSS Vulnerabilities Joe Hancock (Mar 02)
- Re: Knorr.de SQL Injection and XSS Vulnerabilities Michal Zalewski (Mar 02)
- Re: Knorr.de SQL Injection and XSS Vulnerabilities Lolek of TK53 (Mar 04)
- Re: Knorr.de SQL Injection and XSS Vulnerabilities poo (Mar 05)
- Re: Knorr.de SQL Injection and XSS Vulnerabilities Knud Erik Højgaard (Mar 02)