Welcome to Geeklog, Anonymous Tuesday, October 06 2026 @ 03:00 pm EDT

Comments for Fix your Shoutbox!

Fix your Shoutbox! | 7 comments | Create New Account

The following comments are owned by whomever posted them. This site is not responsible for what they say.

Fix your Shoutbox!

Authored by: ScurvyDawg on Sunday, September 28 2003 @ 08:05 pm EDT

Have you sent this to the developers before displaying it here for all to see. I would rather this go the project developers first.

I understand full disclosure but putting it here FIRST is really just kinda dumb.

Good to see people are still hammering on the package to ensure its security. I think most if not all of these items mentioned are plug ins and not part of the core package.

my two cents

Fix your Shoutbox!

Authored by: Anonymous (Anonymous User) on Sunday, September 28 2003 @ 10:33 pm EDT

Yup, yup, yup. They want to be considered security experts because they find a problem yet cannot figure out if something is an add-on plugin or part of the core of a program. This is what is called incompetence. Handing something right to script kiddies by posting to Bugtraq instead of first going to the developers so they have a chance to fix the problem shows this guy is not a true security professional. He's as lowlife as the script kiddies who take his info and do the actual attacking.

Fix your Shoutbox!

Authored by: squatty on Monday, September 29 2003 @ 12:02 am EDT

Well, I wouldn't got that far. I would however seriously question his delivery. Any security professional should be well versed in the CIA triad (confidentiality, integrity, and availability). Publicly posting vulnerabilities without notifying the proper authorities is by no means equivalent to full discloser. It's not like it's hard to find out who to contact. Dirk's name is all over and the mailing list link is highly visible.

Sincerely,
Squatty, CISSP

---
In a world without walls and fences, who needs Windows and Gates?

---
In a world without walls and fences, who needs Windows and Gates?

Fix your Shoutbox!

Authored by: Dirk on Monday, September 29 2003 @ 03:27 am EDT

Unfortunately, this gentleman did not contact us prior to publishing his findings, which is certainly not the way to handle these things ...

The Shoutbox issue should be addressed by the fixes detailed in the story above. The rest is still very much under investigation. It seems, however, that you can at least use this to expose sensitive information under certain circumstances.

bye, Dirk

Search

Resources

About

Getting started

Support

Development

Topics

User Functions

What's New

Articles last 4 weeks

Comments last 4 weeks

Pages last 4 weeks

Links last 4 weeks

Downloads last 4 weeks