Comments on: On Security Vulnerabilities http://kveton.com/blog/2006/11/26/on-security-vulnerabilities/ Father, entrepreneur, pizza maker & bacon lover Mon, 22 Feb 2010 20:18:16 +0000 http://wordpress.org/?v=2.9.2 hourly 1 By: j3h http://kveton.com/blog/2006/11/26/on-security-vulnerabilities/comment-page-1/#comment-3393 j3h Mon, 27 Nov 2006 21:37:38 +0000 http://kveton.com/blog/2006/11/26/on-security-vulnerabilities/#comment-3393 We have just made a release that changes the behavior so that it rejects sign-ups even if the entered credentials match an existing account. This should make the sign-up process less confusing if people are testing it. We have just made a release that changes the behavior so that it rejects sign-ups even if the entered credentials match an existing account. This should make the sign-up process less confusing if people are testing it.

]]> By: kveton http://kveton.com/blog/2006/11/26/on-security-vulnerabilities/comment-page-1/#comment-3387 kveton Mon, 27 Nov 2006 15:44:11 +0000 http://kveton.com/blog/2006/11/26/on-security-vulnerabilities/#comment-3387 For the very reason that you have not given me any cause to do so. From previous experience, I'm not convinced you could do a thorough analysis. I'm sorry we didn't get back to you as quickly as we normally respond to such events. However, the timing of these events were correct, we simply failed to notify you in a timely fashion. You continue to question my integrity at every opportunity and yet you have not shown one bit of proof of a security vulnerability. For the very reason that you have not given me any cause to do so. From previous experience, I’m not convinced you could do a thorough analysis.

I’m sorry we didn’t get back to you as quickly as we normally respond to such events. However, the timing of these events were correct, we simply failed to notify you in a timely fashion.

You continue to question my integrity at every opportunity and yet you have not shown one bit of proof of a security vulnerability.

]]> By: Dmitry Shechtman http://kveton.com/blog/2006/11/26/on-security-vulnerabilities/comment-page-1/#comment-3386 Dmitry Shechtman Mon, 27 Nov 2006 10:57:46 +0000 http://kveton.com/blog/2006/11/26/on-security-vulnerabilities/#comment-3386 Full disclosure is open source to me. Why didn't you agree to open your code repository, not even under NDA? And <a href="http://test.phpbb.cc/viewtopic.php?p=78#p78" rel="nofollow">what's wrong with your clock?</a> Full disclosure is open source to me. Why didn’t you agree to open your code repository, not even under NDA?

And what’s wrong with your clock?

]]> By: kveton http://kveton.com/blog/2006/11/26/on-security-vulnerabilities/comment-page-1/#comment-3371 kveton Sun, 26 Nov 2006 21:41:55 +0000 http://kveton.com/blog/2006/11/26/on-security-vulnerabilities/#comment-3371 That wasn't the only place you made that public claim: http://startrekguide.com/forum/viewtopic.php?p=12128 We take security seriously here so we respond to any and all questions about the quality of the services we provide. Test site or otherwise, people might happen upon that site via Google and not know its a test site. I'd rather err on the side of full-disclosure and discussion than not. Thanks for the post Dmitry! That wasn’t the only place you made that public claim:

http://startrekguide.com/forum/viewtopic.php?p=12128

We take security seriously here so we respond to any and all questions about the quality of the services we provide. Test site or otherwise, people might happen upon that site via Google and not know its a test site. I’d rather err on the side of full-disclosure and discussion than not.

Thanks for the post Dmitry!

]]> By: Dmitry Shechtman http://kveton.com/blog/2006/11/26/on-security-vulnerabilities/comment-page-1/#comment-3370 Dmitry Shechtman Sun, 26 Nov 2006 21:36:10 +0000 http://kveton.com/blog/2006/11/26/on-security-vulnerabilities/#comment-3370 As I repeatedly noted in our conversation, a test board hardly counts as an arena for public claims. But since we have gone public with this now, here are a few backlinks: http://test.phpbb.cc/viewtopic.php?t=37 http://test.phpbb.cc/viewtopic.php?t=38 Vulnerability or not, coverup or not — you are invited to draw your conclusion. As I repeatedly noted in our conversation, a test board hardly counts as an arena for public claims. But since we have gone public with this now, here are a few backlinks:

http://test.phpbb.cc/viewtopic.php?t=37
http://test.phpbb.cc/viewtopic.php?t=38

Vulnerability or not, coverup or not — you are invited to draw your conclusion.

]]>