I would like to say that I think it is unlikely that L19 can expect legal trouble for its users posting security flaws on other websites (although keep in mind I am no expert). obviously if someone gets hacked because of a security flaw, it is their fault for having the flaw not our fault for noticing it (Really it is the hackers fault but...). I do on the other hand think it is rude to post a security flaw without contacting the developers first, so I am unsure where I stand on this particular rule.

As far as I'm concerned, we should adopt a policy of not posting other's security flaws. We should concern ourselves with talking about go, not with talking about the "security" of go sites (I'm a kaya.gs founder, and I found the supposed security flaw to be a non-issue, as the most it enabled was masquerading as a founder in a non-permanent environment).

Lax security measures can result in significant damage not only to business ventures, but to individual users. The policy seems to be only concerned about the first. Exposing it in time before anything is at stake (illuck probably would not have posted credit card data even if available online) should be encouraged as it prevents damage later instead of scaring everyone with a new policy, which basically means nobody will post such news even if tremendously helpful to others on this forum.

My first thought on seeing this thread was "probably don't have this policy", but that was based on the assumption someone had actually done some serious hacking and revealed flaws. But then I saw all illluck had done was point out the bleeding obvious that if passwords and usernames are the same you can login as someone if you know their username. To censor this is bonkers, it should be absolutely allowed.

I'd agree that L19 shouldn't become some of Lulzsec postit board for security flaws. However, this wasn't a security flaw. It was an alpha server which hadn't implemented real authentication, and had let everyone using the server know it.

_________________
North Lecale

I believe it is good to post about security flaws. I think the users of the service would like to know. If Amazon had a bunch of security holes that could leak your credit card information all over the place would you rather:

1. Have each flaw fixed one at a time, slowly, without you ever knowing about it

2. Have someone expose the security flaws, so that you now know to stop using Amazon because it does not treat your information with respect

Yeah, maybe in #1 case Amazon will say, hey we fixed some vulnerabilities. But, they have an interest in white washing it. A dis-interested third party can let you know the actual truth about how severe the flaws are.

I'd rather have the discoverer of the security flaw email Amazon privately than to post it publicly on a forum which Amazon might have no idea it even exists until it's already too late.

_________________
http://tchan001.wordpress.com
A blog on Asian go books, go sightings, and interesting tidbits
Go is such a beautiful game.

If you are making an analogy against what happened here, then Amazon would know it exists because Amazon asked for a subforum (or was offered) to be created in the private forum where the security flaw was posted. So Amazon would know about it quickly. Also, in this case, Amazon would know of the flaw already, but didn't do anything about until it was posted publicly.

And what does that have to do with posting on L19 forum? Is L19 a forum where Amazon has asked for security flaws to be posted? Even if so, does L19 have to comply and make a subforum for every entity which asks for a subforum to house security flaws for their own nonrelated sites?

I visit L19 for go related material and in my opinion L19 is not intended as a place for people to post about security flaws of other sites.

_________________
http://tchan001.wordpress.com
A blog on Asian go books, go sightings, and interesting tidbits
Go is such a beautiful game.

I think you misunderstood what I was saying. Kaya.gs subforum was created with input from Kaya.gs founder. They even link it directly from their site.



My final point, is that the founder knew that the security flaw existed, but chose not to fix until the flaw was pointed out in the forums. So I view it as pretty necessary.