+- Sinisterly (https://sinister.ly)
+-- Forum: General (https://sinister.ly/Forum-General)
+--- Forum: The Lounge (https://sinister.ly/Forum-The-Lounge)
+--- Thread: Release or wait for an official patch? (/Thread-Release-or-wait-for-an-official-patch)
Pages:
1
2
Release or wait for an official patch? - 1llusion - 02-21-2013
Hi!
The story:
As some of you know, I found several vulnerabilities in MyBB affecting the current version (1.6.9). As usually, I reported them to MyBB and then made my own patch and released it on my blog. MyBB developers however asked me to put the blog posts down, because they say it will put people at risk. That I should wait for the official release. My argument was, that if I release it AND release a patch, then people will learn and be able to protect themselves before they do it properly.
The question:
What is your opinion on it?
Should hackers release their research together with their unofficial patch or should they wait for the official release?
RE: Release or wait for an official patch? - LightX - 02-21-2013
I believe that it would be good to release it yourself unofficially because then you get 1:credit, and 2 people to actually see it and be able to learn from it instead of it just being fixed. Just my opinion.
RE: Release or wait for an official patch? - LoneDevil - 02-21-2013
That's why I hate most places they will complain when you fix their shit (for free mind you). Then they'll come around and "fix" it themselves, and just fuck it up worse than it was before.
I bet their patch will add more exploits than there was before.
RE: Release or wait for an official patch? - HACK - 02-21-2013
Hell yea i believe in everything being open source and that people have the right to know how to fix !
RE: Release or wait for an official patch? - chmod - 02-21-2013
You have a right to free speech and at the end of the day you took it upon yourself to do the extra work and make a patch to close the hole, they shod be thanking you, not telling you to take it down carry on with the great work you're doing and screw what they say
RE: Release or wait for an official patch? - Ex094 - 02-21-2013
It's your blog and you had made that patch so I'll say Yes, Release so that people can learn about it.
RE: Release or wait for an official patch? - Solixious - 02-21-2013
I don't see anything wrong in posting the exploit and patch unofficially in your blog. It could put some ignorant admins of few forums at risk
RE: Release or wait for an official patch? - Nailo - 02-21-2013
you made the patch you get the credit and the traffic that will bring.
RE: Release or wait for an official patch? - Shining White - 02-21-2013
probably it will come to harm way , but as a hacker always believe in freedom
RE: Release or wait for an official patch? - 1llusion - 02-21-2013
(02-21-2013, 06:03 AM)Solixious Wrote: I don't see anything wrong in posting the exploit and patch unofficially in your blog. It could put some ignorant admins of few forums at risk
exactly my thoughts. If the admin wants to be secure, he will find the patch. If he doesn't... well then he will get hacked anyway.