> No contact or thanks has been received back so far WTF.
They fixed the bug which is the important thing. Corresponding back to the hacker probably involves the legal dept and it's probably safer to not respond at all.
I pwned half of America's fast food chains simultaneously
221–230 of 513 posts
Re: I pwned half of America's fast food chains simultaneously
#222> Timeline (DD/MM) > 06/01 - Vulnerability Discovered > 09/01 - Write-up completed & Emailed to them > 10/01 - Vulnerability patched Note those dates are DAY-MONTH. At least they patched it within a single day. I find it funny that the author found a massive vulnerability but chose to wait a couple days to report it so they could finish a nice write-up. Reminds me of my experience with HackerOne: We had some particip…
Maybe also include in your quote that they didn't thank him for reporting it
Re: I pwned half of America's fast food chains simultaneously
#223Earlier quoted context omitted.
I guess three clues: * They were just trolling Firebase accounts for anything left open, and the first hit was a company that works with a bunch of American fast food chains. That doesn't require OP to live in the US. * They specified "America's fast food chains"; someone living in the US probably wouldn't qualify it with "America's". * They used a $DAY/$MONTH date format, which is uncommon in the US.
* If they are in America, they're a time traveller.
they discovered the vulnerability by reading about it on HN and then going back with the posted write up, classic lazy time travelers.
Re: I pwned half of America's fast food chains simultaneously
#224Earlier quoted context omitted.
Except it is almost perfect — it would have been perfect had he been thanked and rewarded. Of course that is not on him, but felt so disappointed reading that at the end.
It's been less than 24hours. I don't think any company works at that speed.
Oh come ON. Sending an email acknowledging the report and saying "Thanks so much for reporting this - we will look into it ASAP" takes about 10 seconds
Re: I pwned half of America's fast food chains simultaneously
#225> Timeline (DD/MM) > 06/01 - Vulnerability Discovered > 09/01 - Write-up completed & Emailed to them > 10/01 - Vulnerability patched Note those dates are DAY-MONTH. At least they patched it within a single day. I find it funny that the author found a massive vulnerability but chose to wait a couple days to report it so they could finish a nice write-up. Reminds me of my experience with HackerOne: We had some particip…
> I find it funny that the author found a massive vulnerability but chose to wait a couple days to report it so they could finish a nice write-up.
That's what you'd expect: finding != understanding, and you need some understanding before you can submit a sensible, actionable report to the vulnerable party. And then you need to write it up in a way that will be understood by the recipient. Going from initial finding to submitting a detailed report in a few days is excellent turn-around time.
Re: I pwned half of America's fast food chains simultaneously
#226Earlier quoted context omitted.
Shame is absolutely a valuable tool for change. Without it society would not function since many of our 'rules' are self-enforced.
Nope, shame is ineffective as a tool for change. More often people shut down or ignore you if you attempt to shame them than actually make the change you want. Besides, it's frequently just about vengeance anyway. Shame is really hate of other, for the most part. As a tool for oppression however, yes it's quite effective.
>More often people shut down or ignore you if you attempt to shame them than actually make the change you want.
shame as a tool of change does not work on the person being shamed at the time, it works on that person for the future hopefully as they will be afraid to be shamed again and it works on changing the behavior of other peoples because they don't want to get shamed either.
Thus as a tool of oppression, as you pointed out, it works great. But also as a tool for enforcing otherwise non-enforced social rules - until of course you meet someone shameless or who feels at least that they can effectively argue against the shaming.
Re: I pwned half of America's fast food chains simultaneously
#227> Timeline (DD/MM) > 06/01 - Vulnerability Discovered > 09/01 - Write-up completed & Emailed to them > 10/01 - Vulnerability patched Note those dates are DAY-MONTH. At least they patched it within a single day. I find it funny that the author found a massive vulnerability but chose to wait a couple days to report it so they could finish a nice write-up. Reminds me of my experience with HackerOne: We had some particip…
[deleted]
Re: I pwned half of America's fast food chains simultaneously
#228> Timeline (DD/MM) > 06/01 - Vulnerability Discovered > 09/01 - Write-up completed & Emailed to them > 10/01 - Vulnerability patched Note those dates are DAY-MONTH. At least they patched it within a single day. I find it funny that the author found a massive vulnerability but chose to wait a couple days to report it so they could finish a nice write-up. Reminds me of my experience with HackerOne: We had some particip…
I feel I should clarify, the writeup was not the blog but rather than vulnerability disclosure report (PDF) I sent to them directly.
To clarify the dates, the vulnerability was discovered on a Saturday (Friday evening) their time. It was reported on Tuesday (Monday their time)
The only email listed on their site was for the sales team which would not be checked on a weekend.
Re: I pwned half of America's fast food chains simultaneously
#229This is the most perfect blog post. ZERO fluff, straight to the point. Win.
[deleted]
Re: I pwned half of America's fast food chains simultaneously
#230Full permissions for a user is blatant negligence. For anyone who's never used Firebase before this is as simple as a single piece of logic that appears basically as: if authUserID is UserDirectoryID That simple.
[deleted]