Comments on: To blog or not to blog, that is the question

By: Mark O'Neill

Mark O'Neill — Tue, 22 Jul 2008 14:03:39 +0000

In your dreams. No way am I linking to him.

By: Anonymous

Anonymous — Tue, 22 Jul 2008 13:49:21 +0000

I wanna see that blog!!

Telling google about the security breach would be pointless because big companies don’t listen to little people’s complaints. They can’t read every single piece of mail they get from their millions of users.

By: Andy Willingham

Andy Willingham — Mon, 21 Jul 2008 16:13:35 +0000

Mr. Anonymous, It appears that you are also guilty. Just as I asked earlier to ensure that Mr. O’Neill had done his homework you need to do yours also. Have you asked if Mr. O’Neill has gone to Google about this or are you just blasting him b/c you want to blast someone? Also, if you are going to blast someone at least have the balls to post your name.

By: anonymous

anonymous — Mon, 21 Jul 2008 15:00:46 +0000

well if you are so intently trying to email this said person about the issue at hand and he has not answered you… then why are you waisting your time blasting about what he did or what he did not do and not just go directly to Google Gmail about the loop hole… I mean your here running up and down and how he is a bad person here and he is going to do harm there… well Mr. O’ Neill why not be a good citizen for all of the gmail users, and just like the story you recanted of how you assisted AVG, then for God sakes go ahead and speak to Google directly, take them to this person blog, and point them in the direction of the issue so that they may fix it… I dont know about you, but blasting the poor sucker here is not going to help Google fix the issue any sooner…. and who knows that may be some more brownie points for you, no?

By: Mark O'Neill

Mark O'Neill — Sun, 20 Jul 2008 11:55:46 +0000

right….so when a spammer from Eastern Europe has your Gmail login details and they’re having a good time with them, I’ll check back with you and see if you think “the dude” still did the right thing.

By: Oolis

Oolis — Sun, 20 Jul 2008 10:50:27 +0000

Full Disclosure all the way. You keep a hole a secret and only inform the responsible company, then the company sees it as a PR issue and just covers it up, meanwhile crackers learn about the hole, users get compromised, and 3rd parties don’t get around to fixing the hole till later. A hole is still a hole if its kept a secret.

With full disclosure, people are informed and can make plans to mitigate against risk, the company has more incentive to fix the problem rather than cover it up, and third parties have the information to need to provide fixes in case the responsible parties don’t respond quick enough.

The dude did the right thing.

By: Barbara Ling, Virtual Coach

Barbara Ling, Virtual Coach — Sun, 20 Jul 2008 09:42:59 +0000

Eeek.

Now that is a very irresponsible thing to do. I hope enough people gently point this out to the person in question so he can buy a clue for the future.

Data points, Barbara

By: Antonio

Antonio — Sat, 19 Jul 2008 19:44:56 +0000

Your most definitely right that he is unaware of what the right thing to do is. I think someone needs to let h im know what the right thing is to do instead of insulting him, I guarantee before Mark decided to help AVG he thought of doing the same, blogging about it until someone guided him in he right direction. So someone let the guy know.

By: Andy Willingham

Andy Willingham — Sat, 19 Jul 2008 17:52:00 +0000

I wasn’t accusing you. I’ve just seen people blast others w/o knowing all the facts. If he won’t respond to your emails then he may well deserve whatever he gets.

By: Mark O'Neill

Mark O'Neill — Sat, 19 Jul 2008 14:23:54 +0000

I have emailed him and he hasn’t answered.

I don’t think it is irresponsible of me to criticise someone who publicises to the whole world how to find a security hole in Gmail which lets you see everyone’s email address. I’ve just checked and the page is still up and running.

By: Andy Willingham

Andy Willingham — Sat, 19 Jul 2008 12:07:54 +0000

Have you contacted him to ask him when he discovered this and has he contacted Google? If not then it is pretty irresponsible of you to blast him on your blog without knowing all of the facts.
I may be wrong but if this is the post that I’m thinking of and I remember correctly who wrote it, it has been removed from his blog. Of course my memory may fail me.

By: Mackenzie

Mackenzie — Fri, 18 Jul 2008 21:26:16 +0000

This is an issue of responsible disclosure. What he did was not responsible disclosure, and is considered unethical in the computer security industry. It is only acceptable to go public after the company in charge has been notified, has had a chance to fix it, and has still ignored it.