Yesterday I found an XSS
vulnerability in the Blog4Umbraco package, and after I'd found
it I did what I thought was right. I documented the vulnerability,
and the solution,and posted it on the forum at Our Umbraco. At first glance,
that might seem right. However, I've now had time to consider the
approach properly.
I tweeted my findings, and after a few minutes I got a mail from
Umbraco Founder Niels Hartvig, saying that he would've loved a
heads-up before I posted. Yeah, I should've given him that. My post
may have been informing and all, but giving the Umbraco team a
heads-up would've made sure that a solution was made
re-distributable from them, instead of having developers finding
the solution - if they were looking - on their own.
The next time I find a vulnerability, I know the order of
things.
- Document the vulnerability.
- Notify the distributor.
- Wait for a fix, and an OK to publish.
- Publish.
But what I want to know is, where's my piece of flare? :)