Netscape Responds To Hacker's Claims
The hacker that cracked Netscape's cross-site scripting (XSS) vulnerability and used it to deface the company's answer to Digg.com maintains that he tried incessantly to contact Netscape about the problem to warn them before hand. Netscape thinks he didn't try hard enough.
"Luckily for us, we already had code on the way out the door to address this and similar possibilities. The matter was resolved in hours, if not minutes," he said. " We work hard, we work late -- but there are a ton of script kiddies in the world."
Rudloff denied that Netscape had ignored repeated warnings, but didn't speak specifically to one instance.
"A number of people, internal and external, have forwarded me XSS warnings and were responded to," he said. "There is rarely anything sent in that isn't sent in by a dozen other people, especially oversights like XSS."
"We do our best to read everything that comes our way and we respond where we can. There are 4 developers yet thousands of e-mails."
He said any hacker could easily get into contact with the Netscape developer team via email and instant messenger through a simple Google search.
"We're extremely transparent and open. Posting vague story submissions that get buried quickly by the community and/or anchors is probably the least effective way to do it though."
0 votes
