418

I am a teapot

[418 @amiateapot]

@IceSolst Are we spreading misinfo or can you show me where they threatened to sue?

[418 @amiateapot]

@Cyboghostginx @TalBeerySec @OpenAI Ive worked in disclosure for years and do BB but I guess I know nothing.

[418 @amiateapot]

@caseyjohnellis @scotchandcode few things I think are controversial:

- using a 0 day in discourse to pivot rather than reporting directly to discourse
- enuming employees to find which account to use to ship a PR
- dunking on the CISO who took time to directly communicate with them, which I feel isn't common

[418 @amiateapot]

@PrevidianCyber @TalBeerySec @OpenAI You work with the team to see if they would permit pivoting... You don't take take it to an extreme and pivot, you stop report the issue and work with the team... SSO issue was on openai and that's where the report should of ended

[418 @amiateapot]

@S1r1u5_ With additional parties before discourse is able to get a patch out which simply isn't responsible or good faith research. It arguably increases the likelihood of that 0day being exploited.

Plus enuming exployee access to find who could push a PR..but yeah "this was responsible"

[418 @amiateapot]

@S1r1u5_ Wiz constantly steps out of line, they stunt hack also... It's different than cating a flag file because after getting level employee access in discourse you exploited a 0-day in discourse to help pivot (before reporting it to discourse). now you've shared unpatched vuln....

[418 @amiateapot]

Fucking insanity rn, "I don't like dealing with normal disclosure processes or triage times so I will violate federal laws and break every established norm in responsible disclosure"

[418 @amiateapot]

@Cyboghostginx @TalBeerySec @OpenAI This is nonsense they had proven impact before they pivoted

[418 @amiateapot]

@PrevidianCyber @TalBeerySec @OpenAI They found the bug knew it was critical then probed specific employees level of access to pivot. That isn't responsible that's stunt hacking.

[418 @amiateapot]

@alexstamos 🎯

[418 @amiateapot]

@valmianski @HackerOn2Wheels They didn't get stuck in triage hell? Their timeline they posted shows how fast it was fixed after reporting...

Commiting crimes because you are afraid of slow triage times is the dumbest justification I've heard

[418 @amiateapot]

@zeyu1337 Dawg every professional that works in security is deny listing your company as a vendor and all of y'all as potential hires.. GGs

[418 @amiateapot]

@krishnanrohit This had nothing to do with systems that might be able to do xyz in 5-10 years

[418 @amiateapot]

@aylacroft

[418 @amiateapot]

@ciphergoth @S1r1u5_ The bug bounty team seeing this dude post like he's gonna mandate shit to them

[418 @amiateapot]

@ciphergoth @S1r1u5_ Ahh so you will look over policy breaches and literal illegal behavior, good to know you are in such a position

[418 @amiateapot]

@gergely_kalman @LiveOverflow 😅😂

[418 @amiateapot]

@VideoCardz the upmost respect to a winged toaster who tried to make BB happen the right way at Intel. Intel has some good folks pushing for bounty but some really bad C level leadership who would rather get pwnd

[418 @amiateapot]

@IntCyberDigest It was stunt hacking

[418 @amiateapot]

@netspooky But they didn't ? Openai probably did something worse but wait what's that old fucking saying... Wait I got it.

Two wrongs don't make a right. Shits pretty simple