– mkh

Patrick: I think the approach you (& Norbert) outlined will help more people in the end. And to me, that’s what’s important.

I can’t help but think about the Dale Carnegie book “How to win friends and influence”.

If Ben’s goal was to get the CSRF issue, fixed then really he needs to change his approach. Each one of the 12 items below can apply.

Twelve Ways to Win People to Your Way of Thinking
1. Avoid arguments.
2. Show respect for the other person’s opinions. Never tell someone they are wrong.
3. If you’re wrong, admit it quickly and emphatically.
4. Begin in a friendly way.
5. Start with questions the other person will answer yes to.
6. Let the other person do the talking.
7. Let the other person feel the idea is his/hers.
8. Try honestly to see things from the other person’s point of view.
9. Sympathize with the other person.
10. Appeal to noble motives.
11. Dramatize your ideas.
12. Throw down a challenge & don’t talk negative when the person is absent, talk about only positive.

So much of what we do as security professional requires this. I’m sure the majority of technical people feel their systems are secure. Who wants to admit they don’t understand what they are doing? Who wants to be told they screwed up? There is a better way.

We have to be influential in our approach. Showing respect and being friendly are always important.

Good work on the article

Cheers,
Norbert Griffin

Thanks for commenting. Yes, I’m with you guys; I think Ben did a good thing, and actually did go above and beyond (further than I’d probably have gone before authoring this post). With the post I was just trying to think about how far beyond one would have to go to get through to the truly truculent.

Ali,
Yup; public disclosure always has to be on the table in our minds, but there’s no need to whip it out in the first email.

Rafal,
The patch-breaking behavior just does it for me: that’s beyond ridiculous, though it does show that ego is in play I think that probably vindicates Ben that nothing would have made the difference, but my post was a bit of a thought experiment anyway.

CG,
Yes! OWASP FTW! Though, I did note that the countermeasures discussion on the CSRF page is java-centric. The ideas are of course portable, but maybe the page should make that clear. (http://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet)

Good to see some new faces!

Cheers,
~PST

Daniel should be happy that Ben even sent him an email about the problem before going public or blogging on it. The lack of knowledge about basic web attacks also means that the opencart team should probably spend some time on the OWASP site.

Sad.

/Raf

Ben went very very far, i don’t think i’d go like that

-0xAli