4

Consider this situation: Suppose I find a potential vulnerability in a famous web application, and also report it to the web application's bug bounty program, but do not hear from them in a long while, thus rendering me clueless whether the bug that I had disclosed to them is valid or not. Is it OK to discuss about that here at Security Stack exchange to see if my finding was indeed a genuine one ?

2 Answers 2

2

It depends upon precisely what question you would be asking. I'd have to see the question you posted to be sure; without seeing it, my guess is that this site is not a perfect fit, though it could easily go either way.

If you post a question describing specific vulnerability in a particular version of a particular web site and asking whether it is indeed a valid vulnerability, well, that might end up being a narrow and localized question. It would probably be localized in applicability, because it is only relevant to a single web site. (However, the applicability might depend upon how widely-used the web site is.) It would probably be localized in time, because it would only be relevant to that particular version of the software and would become irrelevant as soon as the website is updated. (However, the applicability might depend upon how novel and interesting the vulnerability is in its own right, and whether there are any new lessons of lasting interest to be derived from it.)

Anyway, I'm just guessing and speculating, so don't take my answer too seriously. I think one way to approach it is to ask yourself: is this the sort of question that is of lasting interest to a significant community of folks? If yes, it is probably on-topic. If not, it might squeak by, but it doesn't sound like a clear-cut case that is on-topic.

If you're not sure whether the question is on-topic, I suggest posting it and then folks can form their own opinion once they have something specific to look at. At worst, if it is off-topic, it'll be closed, and no great harm done.

And, of course, it is possible your experience with this vulnerability might suggest a question of broader interest: e.g., how to confirm whether such-and-such class of vulnerabilities are indeed exploitable; how to avoid such-and-such type of vulnerability when building web applications; how to report vulnerabilities in a way that maximizes the chances that the public interest will be served; etc. Those could be great questions for this site, if they haven't already been asked here.

1
1

I believe it would be. As long as the discussion has depth to it, I think it should be acceptable.

1
  • 3
    Just to make sure it's explicitly mentioned: per the FAQ we expressly practice responsible disclosure here.
    – Scott Pack
    Sep 24, 2012 at 0:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .