There are security companies that buy these kind of information from you (like antivirus companies), so that they can patch the breaches themselves and proudly announce they discovered a breach and only by using their software you can be protected.

I don't know how legal it is, and I understand that the breach finder wants to publish his findings himself (for "reputations points" maybe ?), and he might lose this right by selling an info, but at least he's getting something out of this. IANAL, but i'm pretty sure you could get in trouble for publicly posting information on how to hack a public service (or pretty much anything for that matter)

If only the company is put in danger and they stubbornly refuse to resolve the issue, I'm not exactly sure why anyone would work so hard to convince a company to do this. The job of reporting the issue is done, a corporate decision has been made. If that decision is to remain vulnerable, as long as it does not affect users directly, why bother?

Unless, as others suggested, you can legally make a profit out of it, then by all means! Otherwise, just let it go...

From an ignorance and slightly tongue in cheek POV...

...is there a difference between discovering a new exploit and discovering a company is open to an old or well known exploit? This sounds like the latter.

I'm all for disclosure of a newly found exploit because by doing so you are informing every one who might have the problem and that allows them to take action, etc. But if this is just one business who refuse to fix a known problem then, well, that's their stupidity, no?

See, the bit that bothers me is that publishing the "news" that one company is vulnerable has to be a bit iffy. Its like publishing a list of buildings that don't have good door locks or something. We don't see that in the real world, so why would it be reasonable for the IT world? I mean, there is no legitimate list of vulnerable buildings created by white hat burglars, is there? Its never been legit for such burglars to gain access to a building and leave a note describing the poor security on the CEO's desk.

I don't know how big the company is, but after a certain bigness, all of the people who could fix problems like this have moved on. The only people left are managers who fix "problems" with lawyers. A classic "when all you've got's a hammer" situation.

They might not be refusing to fix the problem. They might actually be unable with the tech talent they've got left.

My advice? Don't look like a nail.

If you contacted them non-anonymously first, you made a mistake, because they can and will sue you if you disclose it. Judges don't understand computers and US courts are all about draining money from someone, so they still might ruin you out of spite even if you disclose it in a way that there's no proof it was you or if someone else who discovered and released it on his own.

The correct way would be: 1) discover a vulnerability 2) contact them anonymously 3) if they don't fix it, anonymuosly release it to general public

That way, you can still help them while protecting yourself. The third step is optional of course.

You almost sound like you're laying down an ultimatum to the company, you've done your job by notifying them so let sleeping giants rest. If it's a known exploit I don't see any reason to publish your findings, if it's something you've come across that hasn't been published than by all means publish away.

The linked post is talking about a DoS vulnerability of the service. It doesn't impact other entities than the service provider (beyond the obvious potential for service outage of its users). I think telling them about it is all that's required. Either they fix it or they don't, that's between them and their users.

Public disclosure won't help btw. half of sites here didn't fix anything(http://homakov.blogspot.com/2012/03/hacking-skrillformer-mon...)

I'm curious what we could change legally to make this less an issue. There's a clear conflict of interest between doing a public good by disclosing a vulnerability and not wanting to risk (at worst) the FBI coming after you or (at best) losing clients. I would certainly consider it unethical to know of a vulnerability and not disclose that information publicly, but there are so many hurdles to doing so that I don't blame some people (especially those who are less established) for not doing so.

It almost makes me feel that there should be a law requiring disclosure of vulnerabilities.

He could just leave them alone and do nothing. It's their service and if they don't want to respond then let them leave the vulnerability open. It doesn't affect user privacy so there is no duty to fellow users as there is in some other cases where a vulnerability being left open means people could be losing private information on an ongoing basis.

Pastebin, then on a disclosure list.

Seems pretty straightforward to me -- since it's a DoS that doesn't put users' information at risk, just publish it without naming the company.

Couldn't this vulnerability simply be published without mentioning who is directly affected? E.g. "under x and y circumstances, it is possible to do z and everyone is advised to check and correct this".

If this is not an option it means it is something very specific of that company, and what would be the purpose on releasing the vulnerability to the public?

You should contact them. If that fails, make a commit to the Rails project.

There should be a scientific journal for this sort of thing.

Take your business elsewhere is step 1. Your information/service is not guaranteed if they aren't willing to protect it.

Everything takes time and money. It may get fixed, eventually. What does 'refusal' amount to?

Move on, work on something new.

I recommend two shots of wheatgrass and a smoothie.

I'm sure Randal Schwartz can offer some advice on this.

Name and shame.

If you really want them to fix it, whatever you decide, be anon about it. If you want your name attached to it, move on.

Use It.

I think you're supposed to exploit the vulnerability in relatively innocuous but deeply disturbing ways, get banned, then complain about how you only meant well, then be lauded on Hacker News as a martyr who should have been embraced by the hacked company.

Nothing. If they're unwilling to fix it, they'll end up facing the consequences when someone less scrupulous than yourself discovers it. If you do publish it, odds are they'll issue a DMCA takedown and try to sue.

Speaking from experience...

  Its never been legit for such burglars to gain access to a building and leave a note describing the poor security on the CEO's desk.

Unless, of course, you happen to be Richard Feynman. Which most of us aren't.

http://www.silvertrading.net/articles_lagniappe_01_richard_f...

>I mean, there is no legitimate list of vulnerable buildings created by white hat burglars, is there?

But the interesting question is not whether such a list has ever been written. The interesting question is whether such a list is legal to write.

Maybe such a list would be beneficial in the long run. Anyone who has practiced lock-picking knows that most lock-based security is little more than an elaborate honor system.

> I'm all for disclosure of a newly found exploit because by doing so you are informing every one who might have the problem and that allows them to take action

You also assume that it is the company that will suffer and they are the ones that have to take action. A lot of companies are public facing companies that store and maintain sensitive customer information. I thought the main reason to disclose the research is not to help the company not lose millions at the end of the quarter but to warn their customers that this company can potentially leak your information.

> Its like publishing a list of buildings that don't have good door locks or something.

It is like publishing a list of buildings that store others belongings (like a bank) that doesn't have locks on them. You want to disclose that fact because chances are someone else found the vulnerability and is exploiting it. It would actually seem very irresponsible to not disclose it in that case (after say it turns out many people's stuff goes missing).