I applaud Gobbles for finding the vulnerability and reporting it so that it can be fixed. However, I find it highly unethical to pass the exploit around to their friends for a few weeks before reporting it. That is the kind of action that can lead to legal action.

In another exploit found by Gobbles, they say "If you can't figure out how to work with this exploit ..., really there is no reason for you to be using an exploit."

I'd like to take it a step further and say altogether that there is NO reason to be using an exploit. If you're talented enough to exploit a system, then put that coding skill to good use and stop malicously messing with people.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/493/13147#13147