• 32 Posts
  • 446 Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle
  • Recurring incidents like these raise the question, how does one strike a balance?

    Relentlessly reporting theoretical vulnerabilities can leave open-source developers, many of who are volunteers, exhausted from triaging noise.

    On the flip side, would it be ethical if security practitioners, including novices, sat on what they thought was a security flaw—so as not to inconvenience the project maintainers?

    This was already answered in the article: verify your security findings. Make a POC that actually exploits the vulnerability, then submit it with your report.