> loading…
> loading…
Cool. Tell us how so we can fix it.
Look, we get it. The security industry has this weird relationship with hackers - we need you to exist to justify our business, but we pretend we want to stop you. Let’s skip the corporate BS and be real about this.
soc@neosecurity.nl
PGP key available at /neo.pub if you’re into that OpSec life
From Phrack Issue 64, Article 4:
"There is something strange, really strange. I always compare the security world with the drug world... Do you really think that security companies want to eradicate hackers?"
→ Read the full article on phrack.orgThe author was right. The security industry needs hackers to exist. Without threats, there's no business. Without vulnerabilities, there's no reason for security companies. It's the same paradox as the war on drugs - everyone pretends they want to win, but nobody actually wants the war to end.
So let's be honest about this relationship. You find flaws, we fix them. You keep doing what you do, we keep doing what we do. The ecosystem needs both sides.
We're not trying to "eradicate" hackers. We're trying to build better defenses. If you can break our stuff, that's valuable intelligence. We'd rather learn from you than pretend you don't exist.
"We don't need them to exist, we exist because we like learning, learning what we are not supposed to learn." - Phrack 64
soc@neosecurity.nl - we'll confirm receipt within 24h (probably faster)
Is it real? Can we reproduce? What's the blast radius?
Patch, test, deploy. No corporate bureaucracy nonsense.
Public advisory with props to you (if you want them)
Scope: All *.neosecurity.nl subdomains are fair game. Third-party services and customer environments are obviously off-limits. Use common sense.
Props to the researchers who've helped us build better defenses. If you want credit, we'll add you here. If you prefer to stay in the shadows, that's cool too.
Props to the people who found real issues and reported them properly.
Ashik Mohamed
DMARC issues on our scope reported; thanks for the heads up!
If you follow these guidelines, we won't come after you legally. Simple as that.
We won't file charges under computer crime laws if you stick to these rules. We're not interested in making enemies - we want to make our stuff more secure.
Found something? Want to report it? Want to just chat about security? We're here for it. No corporate gatekeepers, no endless forms.
Security findings:
soc@neosecurity.nlPGP key available at /neo.pub for the paranoid (we get it)
glhf, keep your tricks, we'll keep ours 👾