> 2021-12-03 08:42: Jordy tweets and deletes about “read arbitrary files on the host, no authentication needed” (Editor’s note: We were not aware of this until 2021-12-07.)
Doesn't quite sound like an "ethical hacker" to me.
Doesn't quite sound like an "ethical hacker" to me.
On balance, I still prefer if someone approaches us with good intentions and messes up a bit over someone simply dumping a 0day into the wild or into private circles. And this way, we at least had a tested patch in hand already and knew that Grafana Cloud was not affected.
And as per https://news.ycombinator.com/item?id=29495431 ... we all make mistakes.