Annoyed at delays from JSST

[yehgnet]

Hi Joomla! Security Strike Team (JSST - or top-notch security experts)

We submitted few issues at Sat, Sep 11, 2010 to security at joomla.org.

We got your response (Claire Mandville) at Wed, Sep 15, 2010 (Claire told us they would look at the issues) .

Therefore, we asked your status at Sep 18, 2010 through security at joomla.org.
We didn't get any status from you.

Again we asked your status at Sep 27, 2010 through http://developer.joomla.org/security/co ... -team.html.
Again we didn't get any status from you.

Now we've assumed that Joomla! ignored our report and we'll publicize the vulnerability information accordingly in a few days soon at Full Disclosure and BugTraq Mailing lists.
Sorry for excuse like 'Your report was in SPAM and we've now got it'.


Regards
YEHG

[mandville]

Hi
JSST had responded to you after your update request to say that it was unable to reproduce all the reports you submitted.
Please direct all comments to the JSST.

[yehgnet]

In response to the post
http://forum.joomla.org/viewtopic.php?f=432&t=553380 , which was meaninglessly locked,

Hi
JSST had responded to you after your update request to say that it was unable to reproduce all the reports you submitted.
Please direct all comments to the JSST.

How did you make sure JSST had responded to us?

JSST's response from JSST didn't come even to our SPAM box.

Ok, stayed tune.

We keep you posted with our proof-of-concept demo in both backend and front-end.
For this irresponsible-like unfriendly response case which wasted our time a lot, we will not notify you about vulnerabilities in coming 1.6 and future versions of 1.5.

Stay secure,
YGN Ethical Hacker Group

[mandville]

The topic was locked as you were asked to contact the JSST direct for an update on your reports.

<add>
I would also suggest you use one email address when contacting the JSST as all reports are connected to the email address of the reporter

[ooffick]

Just a quick update on Wednesday October 6, 2010 a private message was sent to me and others apologizing for the previous report since it was mixup with an issue in an older version.

Olaf