今日热议主题：当用户向你报告了安全问题你会怎样做

强行热议 ( ﾟ∀。)

刚才刷 feed 时看到这样一条讨论串 Ask Slashdot: What Is the Best Way To Thank Users For Reporting Security Issues? - Slashdot po 主的主要意思就是说他收到了用户发来的消息，报告了安全问题，他想知道到如何感谢这类提交 security issue 的用户。本来我以为底下会说 money, thanks email, bitcoin 之类的，结果竟然有不少人同意了以下观点：

This is a stupid answer.

Here's how you should actually handle people who report security issues:

If you're an IT director and it's a company employee who reported it, you need to inform the upper management that you have a possible hacker in the company, and get his ass fired.

If you work in a company and someone in the general public reported it, you need to notify your legal department so they can file a lawsuit against the person for defamation.

If you're in government and this was reported by someone in the general public of your country, you need to notify law enforcement so they'll be arrested for hacking and thrown in prison.

Only hackers would care about "security issues", and if that information becomes public, it will just help other hackers, so any such people need to be dealt with, extremely harshly. If you disagree, then you obviously are not in a position of power in the US.

虽然让我感到很不爽，但确实是一些公司的做法，简单的说就是甩锅，毕竟因为承认了纯在安全漏洞就等于给了用户发起诉讼的理由。但作为一个运维，有人愿意给我发邮件告诉我伺服器存在漏洞，告诉我问题的 CVE 编号、复现方式、修复方法，我会给他发一封感谢邮件。（虽然类似于有人把我家锁撬了然后告诉我我家的锁不安全）

诸位怎么看呢？

jimwoo

2017-01-10 10:05:37 +08:00

@Explorare 呃～难道程序员就不能注册、就不用吃饭？虽然机率低但也不代表不可能发生啊。

一个程序员肚子饿了，注册某外卖平台，用 keepass 生成密码刚好 SQL 注入了就不行啊……就不行啊～～～就不行啊·～～～

一个程序员去讨论区讨论东西，想教别人怎么破 QQ 相册吸引点妹子关注，一帖 js 代码发现可以 XSS 就不行啊就不行啊～～～

Explorare

2017-01-10 10:13:22 +08:00

@jimwoo 再打个比方，我是你楼上住户老王，有一天我突然打开了你家门，告诉你你家门锁设计上不安全，还友好的告诉你为什么不安全，换哪个锁安全，虽然没有对你造成损失，但这段对话证明了我在该时间点之前是有能力以非法手段打开这个锁的，你就可以说你丢了两千元，起诉我非法入侵偷了钱，正面那段对话对我来说就是非常不利的条件。但如果我说我喝多了走错楼层，用自己钥匙不小心捅开了你家门锁，你大概也不会想这么多了吧。