Twits and disclosure
- TAGS:spam, Twitter, vulnerability
- IT TOPICS:Internet, Security
Are you a Twit?
So are we!
Follow us at Twitter to hear what's coming, what's breaking, what's hot, what's not.
There have been announcements recently from Aviv Raff of some CSRF (cross site request forgery) and XSS (cross site scripting) vulnerabilities in Twitter that can cause the Twits out there some spam headaches. I am a Twit myself, so this bugs me quite a bit. But seriously, if I am going to use this kind of service, then I have to expect this kind of problem. This is another Web 2.0, 3.0, whatever.0 sites that have attracted a huge following. What is important is how fast the staff gets a fix up and going.
What is also important is how disclosure of the flaws are handled, both by the researcher that found the flaw and by Twitter. With all of the recent disclosure debate lately surrounding the DNS flaw, this kind of thing really needs to be discussed.
Take for instance the announcement of the latest flaw in Twitter. The announcement says:
Twitter security team was notified on 31-July-2008.
Technical details will be added as soon as this vulnerability is fixed.
This is the right way to handle the issue. Let Twitter know, let them fix it, and THEN publish the details (note: this is how Dan Kaminsky handled the issue as well). Don't publish the details before the problem has been fixed . I know Twitter is not as important as DNS is to the Internet (though some might argue that - twit addicts), but the point is the same.
Free Insider Guide