Ejection Seats, Cooking Dinner, and Vuln Disclosure

“It turned out to be way easier and much more like a webapp than
I had thought it would be originally. After a couple hours of
poking, I found a huge unauthenticated confidentiality hole. Once
the euphoria wore off, I realized I had a big problem on my hands.
I had to tell my employer’s app owners and we had to assess risk
and make a decision on what to do about it. After some quick
meetings with stakeholders, we decided to severely limit access to
the thing while we worked with the vendor.

“The vendor refused to acknowledge it was a security issue. Odd,
considering most everyone who sees the issue unmistakably agrees
that it is not acceptable. Now I’m forced to play hardball, yet
nobody wants to fully-disclose and destroy relations with this
vendor, whose software is somewhat relied on. Meanwhile, I know
there are hundreds of institutions, small and large, using this
software who have no idea that it has flawed security and who would
probably not find the risk acceptable. What can I do? Nothing. Oh
well, sucks to be them.”

Complete
Story