Yahoo included their private certificate in Axis • Hacker News Board

Re: Yahoo included their private certificate in Axis

#11

Post by sneak » Thu, May 24, 2012, 8:54 AM UTC

It's a key, not a certificate.

Re: Yahoo included their private certificate in Axis

#12

Post by readme » Thu, May 24, 2012, 9:31 AM UTC

sneak wrote: post #10

readme wrote: post #9

Is this responsible disclosure?

There is no such thing as responsible disclosure.

http://en.wikipedia.org/wiki/Responsible_disclosure

Not sure I really agree. I think it would be courteous to politely inform yahoo! of their mistake. Potentially more rewarding, as well.

Re: Yahoo included their private certificate in Axis

#13

Post by JoachimSchipper » Thu, May 24, 2012, 9:33 AM UTC

readme wrote: post #9

Is this responsible disclosure?

See http://news.ycombinator.com/item?id=4016867.

In general, note that the people demanding responsible disclosure (i.e. major vendors) also greatly benefit from it. (In general, creating and enforcing an ethical norm is not itself an ethically neutral act.)

Re: Yahoo included their private certificate in Axis

#14

Post by mike-cardwell » Thu, May 24, 2012, 9:36 AM UTC

Cushman wrote: post #4

Ouch. But we've all had moments of forehead-slapping stupidity; I really feel for whoever let this slip through.

They will never live it down.

Re: Yahoo included their private certificate in Axis

#15

Post by [deleted] » Thu, May 24, 2012, 10:07 AM UTC

sparknlaunch12 wrote: post #6

How hard is it for Yahoo to change their certificate?

[deleted]

Re: Yahoo included their private certificate in Axis

#16

Post by sneak » Thu, May 24, 2012, 11:58 AM UTC

readme wrote: post #12

sneak wrote: post #10

Earlier quoted context omitted.

There is no such thing as responsible disclosure.

http://en.wikipedia.org/wiki/Responsible_disclosure Not sure I really agree. I think it would be courteous to politely inform yahoo! of their mistake. Potentially more rewarding, as well.

http://en.wikipedia.org/wiki/Allah

Lots of things that don't exist have Wikipedia pages.

Re: Yahoo included their private certificate in Axis

#17

Post by sneak » Thu, May 24, 2012, 11:58 AM UTC

mike-cardwell wrote: post #14

Cushman wrote: post #4

Ouch. But we've all had moments of forehead-slapping stupidity; I really feel for whoever let this slip through.

They will never live it down.

The amusing part is that they escaped n rounds of major layoffs, only to be (presumably) canned for something avoidable.

Re: Yahoo included their private certificate in Axis

#18

Post by Karunamon » Thu, May 24, 2012, 12:32 PM UTC

sneak wrote: post #16

readme wrote: post #12

Earlier quoted context omitted.

http://en.wikipedia.org/wiki/Responsible_disclosure Not sure I really agree. I think it would be courteous to politely inform yahoo! of their mistake. Potentially more rewarding, as well.

http://en.wikipedia.org/wiki/Allah Lots of things that don't exist have Wikipedia pages.

Sounds like an affirmative claim, can you prove that? ;)