sense disagree with mope-pr. ALERT! seek clarification?
are you saying its good practice to out people's security vulnerabilities without contacting them first?
are you saying its good practice to out people's security vulnerabilities without contacting them first?
I can appreciate the theoretical outlook you're coming from. Here's what happens when you try to contact idiots first: http://www.google.com/search?q=bitdaytrade+reddit
Look through the posts there, you have actually competent people trying to talk the guy into safety and some strutting imbecile puffing a lot of smoke about the imaginary experts he's hired, the imaginary expertise he has and on and on.
Thus I can certainly appreciate the practical outlook of warning the community first. I guess in the end it all comes down to a judgement call. Did the OP think the failed site is administered by sane people likely to take appropiate measures in a timely and effective manner, or did the OP think the failed site is a scam run by patent liars (Vleisides, Zerlan etc)?
Yes I certainly agree its a tough call between protecting the innocent, and tarring and feathering incompetent admins into taking action.
I think the way that guy did it was better, "you register, ill show you I can get your pw hash" a good mix of publicly outing them, without actually posting the vulnerability itself letter by letter.
(also sorry for MPOE typo on my previous post... autocorrect :/ )
Maybe my opinion is coloured by me having an outstanding order with BFL, but I'm still giving them the benefit of the doubt, in that I understand what they are doing is hard. Maybe that makes me a sucker, time will tell, and if I do lose that money well that will be another one to chalk up to experience. I'm not so naive as to think that every btc 'investment' I make is gonna pay out. Anyway I think thats a different subject!
Me I'd have contacted them at first, and *then* when they didn't do anything start escalating.
