Kevin Beaumont12h ago
Probably going to get a viral blog out of this experience, I'm trying to report a 4tb exposed cloud bucket to a company using their responsible disclosure programme... but they replaced the people with a GenAI ticket system that refuses to discuss the case as it thinks exploring open buckets is unethical and against its rules.
Show threadYet another Josh 

@GossiTheDog

The best answer to terrible processes like that is to publicly disclose exactly what's wrong, with repeatable steps.

You tried discretion. Their sloperation prevented it. So, publish.

That WILL get their attention, and everyone elses' as well.

2:12pmWeb
Show threadCliff'sEsportCorner6h ago
@crankylinuxuser @GossiTheDog I'd be inclined to include the AI reporting issues with documentation in the disclosure as well. Like 3 separate attempts with video capture. Though 3 isn't statistically valid would show not a one off ^^
Show threadJohn Carlsen 🇺🇸🇳🇱🇪🇺6h ago

@CliffsEsport @crankylinuxuser @GossiTheDog

I think that you should show only that you made a reasonable attempt to notify them discreetly, and how they added another layer of incompetence that prevented you from doing so.

They own this one.