Release or wait for an official patch?

1llusion · 02-21-2013, 12:25 AM

Hi!

The story:
As some of you know, I found several vulnerabilities in MyBB affecting the current version (1.6.9). As usually, I reported them to MyBB and then made my own patch and released it on my blog. MyBB developers however asked me to put the blog posts down, because they say it will put people at risk. That I should wait for the official release. My argument was, that if I release it AND release a patch, then people will learn and be able to protect themselves before they do it properly.

The question:
What is your opinion on it?
Should hackers release their research together with their unofficial patch or should they wait for the official release?

LightX · 02-21-2013, 12:30 AM

I believe that it would be good to release it yourself unofficially because then you get 1:credit, and 2 people to actually see it and be able to learn from it instead of it just being fixed. Just my opinion.

LoneDevil · 02-21-2013, 12:32 AM

That's why I hate most places they will complain when you fix their shit (for free mind you). Then they'll come around and "fix" it themselves, and just fuck it up worse than it was before.
I bet their patch will add more exploits than there was before.

HACK · 02-21-2013, 03:50 AM

Hell yea i believe in everything being open source and that people have the right to know how to fix !

chmod · 02-21-2013, 04:29 AM

You have a right to free speech and at the end of the day you took it upon yourself to do the extra work and make a patch to close the hole, they shod be thanking you, not telling you to take it down carry on with the great work you're doing and screw what they say

Ex094 · 02-21-2013, 05:29 AM

It's your blog and you had made that patch so I'll say Yes, Release so that people can learn about it.

Solixious · 02-21-2013, 06:03 AM

I don't see anything wrong in posting the exploit and patch unofficially in your blog. It could put some ignorant admins of few forums at risk Biggrin

Nailo · 02-21-2013, 10:34 AM

you made the patch you get the credit and the traffic that will bring.

Shining White · 02-21-2013, 11:06 AM

probably it will come to harm way , but as a hacker always believe in freedom Smile

1llusion · 02-21-2013, 01:54 PM

(02-21-2013, 06:03 AM)Solixious Wrote: I don't see anything wrong in posting the exploit and patch unofficially in your blog. It could put some ignorant admins of few forums at risk

exactly my thoughts. If the admin wants to be secure, he will find the patch. If he doesn't... well then he will get hacked anyway.