Comment by jmadsen | Hacker News Reader

Comment by jmadsen | Hacker News Reader

Shocking how common this reaction is from people.

I used to play an online soccer manager game. One day I found out - essentially because I had copy/pasted a bit of buggy javascript into their homebrewed forum to help them spot the bug - that the forum itself would execute any javascript a user put into their posts.

Alarmed, I notified everyone I could think of. And waited. Knowing these guys were infamously non-responsive, and that this was a pretty bad issue, I then posted about it for everyone to read to raise an uproar and get their attention. Which it did. And we all waited.

Finally, I posted a small script that popped up an alert with "You've just been infected by a nasty bug", put it in a few places with "tasty" subject lines to get people to click & read it.

Oh, they fixed the bug. I also received from the non-technical Forum Moderators - real quotes, I kid you not:

-- one week forum ban for "taking advantage of a bug" because "someone had to be punished for this"

-- one week forum ban for "spamming the forum" (I had post I had a great player for sale to get clicks, then explained the security flaw instead in the post)

Users were outraged at the bug; moderators of the forum were outraged that I had caused such a PIA by causing all these popups when they were trying to browse the (insecure) forum

I'm going to go out on a limb and day that it sounds as though your behaviour wasn't very responsible. Fair enough - there was a bug, it needed to be fixed. Bringing it to the attention of everyone in the way you did doesn't sound very mature.

Obviously you thought it was urgent and maybe the admins weren't being responsive enough. You have to keep in mind that priorities vary. Always keep in mind, there are real people on the other end who have to deal with this. What if your actions dragged an unhappy parent away from a sick child to deal with a PITA who thought his issue was so important as to demand immediate attention?

> Bringing it to the attention of everyone in the way you did doesn't sound very mature.

It's how security disclosures work if the vendor is not cooperative enough to fix the broken stuff. It's better to get the bug fixed silently, but if you can't get that, then for users it's better to have the problem known widely to public and thus fixed on short notice than for it not to be fixed for a long time, risking exploiting by malicious individuals.

> What if your actions dragged an unhappy parent away from a sick child to deal with a PITA who thought his issue was so important as to demand immediate attention?

It's not OP's problem. One can't take responsiblity for everything people will do because of a comment one wrote. Otherwise you'd have to bill me for the time you spent reading this comment instead of working.

I know who these people were. They were a few young, just out of college, kids running a game site as their "full-time" job.

And by "no response", I meant "no response", not "no fix".

Each of those periods was a 24-hr wait.

I appreciate your sentiment, but in this case I knew precisely who I was dealing with, and their reputation for (not) dealing with things.

I dated a girl for a while who I stayed friendly with after we split up. She posted an online dating profile (circa 2003?) with just enough information about herself to be Google-able. Some guy Google'd her, found her on her university website (she was doing a PhD), and emailed her telling her she should be a bit more careful, and, PS, did she want to go on a date?

She replied calling him a creep, and reported him to the dating site.

To be fair, it's a bit of a creepy thing to do. Just because you _can_ do something, doesn't mean you _should_.

A couple of years ago I notified a female M&A lawyer that worked on the same deal as me, that her Outlook Connect picture was a very sexy lingerie photo that, even though she was very pretty herself, didn't really look like her. One thing led to another and she offered to show me the real thing.

You spot a bug and report it. It's ignored. You make it public. That's it. Don't do anything else.

I think there are some people that can't help themselves. They crave the attention ("Look everyone, I found a bug!"). For those souls, quiet professionalism isn't satisfying enough.

Reply on news.ycombinator.com