54

I'm trying to get a security vulnerability on a Stack Exchange domain fixed for about 8 months, but the lack of progress and communication is frustrating. Unfortunately, asking for status updates repeatedly and offering further details if needed didn't get me anywhere.

Timeline

  • 2017-11-20 Reported vulnerability via contact form (No reply or receipt)
  • 2017-11-28 Inquired via email if the report was received (No reply)
  • 2017-11-30 Created a meta post asking if the report was received (Got confirmation that it was)
  • 2018-02-16 Asked for a status update below meta post (No reply)
  • 2018-02-19 Asked for status update via contact form
  • 2018-02-20 Received response that "someone’s still looking into the issue" and I "should have a status update soon".
  • 2018-07-03 Asked for a status update (No reply)

Being that unapproachable on security bugs not only puts the community at risk, but I feel it's also detrimental to SE's reputation and may discourage other people from reporting vulnerabilities in the future. (I am aware that the XSS flaw I reported is not the end of the world, but there is still a real risk of abuse to a multi-million-user community.)

Posting publicly about the issue here seems to be the only way to grab attention. Would you mind having another look at my bug report and letting me know about its progress?

Improve this question
3
  • 12
    As this is more than seven months ago, and since yo did a responsible disclosure, it might be best to just publicise the security issue.
    – Narusan
    Commented Jul 18, 2018 at 17:09
  • 2
    I don't know why but the official stackexchange reply does not feel satisfying. Maybe concretely state what steps they are going to take to prevent this from happening again? I know a lot of people who would have gone wild and publicly disclosed it after X months. Heck some people would probably have sold it, abused it or bragged about it already. Therefore, kudos to @Arminius for the highly professional and ethical behaviour. We should encourage such people/talent by taking them seriously. It is very frustrating when there's no reply after reporting a vulnerability.
    – HamZa
    Commented Jul 19, 2018 at 8:36
  • 1
    Although I know filtering the real deal from all the BS reports can be quite challenging or at least frustrating and time consuming.
    – HamZa
    Commented Jul 19, 2018 at 8:38

1 Answer 1

Reset to default
35

Our apologies, not super clear on what happened here honestly.

When we saw this post a team member went looking for your ticket, found it (reply should be forthcoming, I don't have access to that system personally) and sent the details my way. A fix has been deployed.

We're going through our old tickets to see if anything else fell through the cracks, and to figure out how this particular issue got dropped on the floor.

Improve this answer
4
  • 19
    As the manager of the team, I'm also reworking the process a bit so we don't drop stuff in the future. Our apologies again.
    – Haney StaffMod
    Commented Jul 18, 2018 at 19:20
  • 14
    Thanks for handling this, I can confirm the bug is fixed now.
    – Arminius
    Commented Jul 18, 2018 at 19:56
  • 3
    Hi, I'm curious - a few months ago there was talk about hiring a Director of Security. Are they already on board? How is this affect both the process, and responsibility for it? Any transparency on this you can share would be super :-)
    – AviD
    Commented Jul 19, 2018 at 12:46
  • 3
    We have brought Lynn on board recently. She's been working hard to document and normalize our existing processes, mostly with a focus on the privacy (PII, GDPR, etc.) and private data (payment data, Teams questions, etc) as they have been high priority lately. She is one of the people working to review this event internally and determining what changes need to be made to prevent it from recurring.
    – Kevin Montrose
    Commented Jul 19, 2018 at 14:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .