She seems a really nice person. Afterall, the exploit fixed would of never been found if it wasn't for her. There's an interesting debate going on in the vBulletin 3.7.2 Release Discussion - Jessica Hope is actually participating in that. Some people seem to think it is wrong for her to give a demo link exploit... well I don't think it is. She reported it in private to Jelsoft first, but they just said it isn't an exploit and dismissed it. So, she reported it publicly. Check it out: http://securitytracker.com/alerts/2008/Jun/1020322.html
Intresting how Jelsoft does not always take concerns seriously.
Where was it posted that Jelsoft does not take security concerns serious? If we would not take it serious, then why are we releasing a patch immediate after the discovery of a new possible exploit?
PS I doubt Jason has private channels that give him any more information then i have, on the contrary.
She told vBulletin about it first. Jelsoft downplayed it, putting their users at risk. So what about blaming them instead of Jessica? They are the ones who didn't take responsibility. But in the end, you have nobody to blame but yourself. It is attitudes like these that are the reason that Storm and others continue to thrive.
I'm reading the discussion thread over @ vbulletin.com and Jessica is posting in that thread.
I'm reading the discussion thread over @ vbulletin.com and Jessica is posting in that thread.
If you would read it good you will find that the discussion is only about the wording in the release announcement.
We did take our responsibility, we did not deny or let go the report, a patch was constructed and released immediate. The discussion is only if we should have classified the real life risk of this vulnerability as Low/Medium/High in the announcement. I can hardly see this as not taking responsibility.
07-10-2008, 06:51 AM
Some people seem to think it is wrong for her to give a demo link exploit... well I don't think it is. She reported it in private to Jelsoft first, but they just said it isn't an exploit and dismissed it. So, she reported it publicly. Check it out: 
Linear Mode
