31–40 of 65 posts
Earlier quoted context omitted.
The guy has no reason to expect a reward if the city has no bug bounty program. They could just sue him.
What are their damages? He's not required to disclose their security vulnerabilities to them. It's his work not theirs.
The most ethical move would have been to write to people listed at https://www.iana.org/domains/root/db/cd.html and put IANA in copy (likely ROOT-MGMT@IANA.ORG as listed in the public document: 24x7 Emergency Process Step-by-Step Description).
He definitely acted decently overall (and did reach out to the people you mention afterwards). But I can empathize with the author for simply thinking "pending renewal? alright whatever" and later on "pending DELETE? shit I should make sure they're OK!".
I guess there's always what's best in hindsight and what's actually done.
I had a gut feeling it will be '.cd' before clicking on the article and I was right. Dealing with the state entity (SCPT) that manages this TLD is quite a pain. It's so painful that I've given up managing all the .cd domains I used to own. .cd domains are also some of the most expensive to get. Hopefully the new government will take this seriously.
> .cd domains are also some of the most expensive to get. Hopefully the new government will take this seriously. I bought one a few years ago for 80 Euros / year. Aren't there a lot of TLDs that are way more expensive?
Many gTLDs are expensive due to their target demographics or to dissuade bad actors (eg .auto, .bank).
I had a gut feeling it will be '.cd' before clicking on the article and I was right. Dealing with the state entity (SCPT) that manages this TLD is quite a pain. It's so painful that I've given up managing all the .cd domains I used to own. .cd domains are also some of the most expensive to get. Hopefully the new government will take this seriously.
> .cd domains are also some of the most expensive to get. Hopefully the new government will take this seriously. I bought one a few years ago for 80 Euros / year. Aren't there a lot of TLDs that are way more expensive?
The most ethical move would have been to write to people listed at https://www.iana.org/domains/root/db/cd.html and put IANA in copy (likely ROOT-MGMT@IANA.ORG as listed in the public document: 24x7 Emergency Process Step-by-Step Description).
The most ethical move would have been to write to people listed at https://www.iana.org/domains/root/db/cd.html and put IANA in copy (likely ROOT-MGMT@IANA.ORG as listed in the public document: 24x7 Emergency Process Step-by-Step Description).
I assume you mean that he should have done that when he noticed the domain was pending renewal? (edited to "renewal", not deletion) He definitely acted decently overall (and did reach out to the people you mention afterwards). But I can empathize with the author for simply thinking "pending renewal? alright whatever" and later on "pending DELETE? shit I should make sure they're OK!". I guess there's always what's bes…
The most ethical move would have been to write to people listed at https://www.iana.org/domains/root/db/cd.html and put IANA in copy (likely ROOT-MGMT@IANA.ORG as listed in the public document: 24x7 Emergency Process Step-by-Step Description).
The reason I think this is problematic is that there are already more than enough people in the security community who will either say "fuck it, I'm not gonna bother with that" or "let's sell it to the highest bidder".
We should appreciate more when people are trying to do the right thing and worry more about the people doing clearly the wrong thing and less about whether the people doing overall the right thing did it perfectly.
It pisses me off that for something of this magnitude this guy will probably only be paid no more than a couple thousand dollars, if at all. He still has no response.
DR Congo is one of the poorest countries in the world. GDP/cap is $457 a year. If he does get a few thousand that is more than one worker earns in 10 years. https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(nomi...
Earlier quoted context omitted.
DR Congo is one of the poorest countries in the world. GDP/cap is $457 a year. If he does get a few thousand that is more than one worker earns in 10 years. https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(nomi...
Understandable stance, but the damage he was capable of causing was probably millions of dollars worth. So yeah, a few thousand bucks as a thank you is reasonable.
That applies to most of us.
It also doesn’t change the fact that there is very little money available in the DRC.
Earlier quoted context omitted.
I work for a few a cities in Europe, and happen to know one of the cities had a site with an sql injection issue. An external person found and let the city know but didn't want to reveal the specifics before getting money. The city has no bounty program and for some people in the City it came across as if the guy was distorting them. The guy probably felt like he didn't get money for his work. Probably both have a po…
The guy has no reason to expect a reward if the city has no bug bounty program. They could just sue him.