Oh, the stupidity

[ZiNgA BuRgA]

(10-26-2010 12:00 AM)MattF Wrote:  Must admit, I agree with the other Matt on this point. It's good form, if nothing else, to notify the author and give them a heads up if you find a problem. By all accounts, if a week or two has passed and there has been no response or update from the author, then make the exploit public to try and force some action, but to do so straight away is awfully bad form.

If you actually expect me to do that, I could spend my entire life reporting cases.
No, I'd rather keep my mouth shut if that was an actual requirement.
As it isn't, I couldn't care less about "good" or "bad" form.  I don't consider myself some altruistic being here.  I do whatever makes me interested.
Anyway, as they say, "no pain no gain".

(10-26-2010 12:00 AM)MattF Wrote:  I'm sure you wouldn't appreciate the scenario happening in reverse if you happened to overlook something in your code at some point, (we all do), and somebody never notified you of it before making it public, so do unto others...

Totally incorrect.  I WANT people to post exploits of my code, but throughout the years, no-one ever has.  I wonder why...