Websmart, Inc. and 100,000 Vulnerable Websites • Hacker News Board

Re: Websmart, Inc. and 100,000 Vulnerable Websites

#71

Post by thyrsus » Wed, Dec 04, 2013, 12:40 PM UTC

emilv wrote: post #66

columbo wrote: post #43

My personal advice to all small-business-owners: Don't get into pissing matches! Yeah, I don't like Sam Bowne's approach. His initial email read as someone looking to make a name for himself (this is the biggest security flaw I've ever found! You have 6 days to respond!). Despite this, if I had received an email like this I would have sent back a personal thank you followed with an outline of action steps. If I get a…

That domain name sure looks like a phishing scam. Six days to take down the websites and start bugfixing is a lot of time for this kind of vulnerability.

It is quite possible the clients do not have access to the source code. They may further have no competence in coding nor even in obtaining competent assistance in coding.

Re: Websmart, Inc. and 100,000 Vulnerable Websites

#72

Post by websitescenes » Wed, Dec 04, 2013, 2:27 PM UTC

This professor is an ass. I would be livid if someone sent me those emails and created a press release. I think this is definitely grounds for legal action. The professor has severely misinterpreted the situation.

Re: Websmart, Inc. and 100,000 Vulnerable Websites

#73

Post by emilv » Wed, Dec 04, 2013, 4:12 PM UTC

thyrsus wrote: post #71

emilv wrote: post #66

Earlier quoted context omitted.

That domain name sure looks like a phishing scam. Six days to take down the websites and start bugfixing is a lot of time for this kind of vulnerability.

It is quite possible the clients do not have access to the source code. They may further have no competence in coding nor even in obtaining competent assistance in coding.

They still should be able to figure out how to take down the website to avoid being exploited.

Re: Websmart, Inc. and 100,000 Vulnerable Websites

#74

Post by sanderjd » Wed, Dec 04, 2013, 4:44 PM UTC

markdown wrote: post #69

adriancooney wrote: post #31

Earlier quoted context omitted.

Who each have to go through the contractor to get them fixed resulting in a bottleneck. Thieves are already running rampant at the disclosure while the contractor is frantically fixing the windows.

An unfortunate series of events, but the poor homeowners are glad it happened, because now they see their contractor for the careless, incompetent fool that he is. They vow never again to put their families at risk by letting him near their house. They find a better contractor.

Having no technical expertise with which to evaluate competing contractors, the "better" contractor they find has the same problem. Cycle repeats.