http://wattahack.blogspot.com/2007/04/resolved-lhdn-e-filing-leaking-data.html

What he did is a common practice among bloggers in developed countries like in the US. It’s even worst there where they sometimes publish all the juicy details at will.

Does this do more harm then good?

It could be harmful but in a way this forces the organization to shorten their response time further. They take security even more seriously instead of delegating beta testing to the unwilling general public.

I agree with you though that ideally the guy should had reported it first. Sadly the reality is less than ideal.

Informing firstly the PIC of the organisation in charge of the application is standard ICT security procedure. I think informing the general public of the vulnerability, even if not the whole juicy details, does more harm than good.

Once the relevant authorities does something about it, then only would I consider going public about it.

Unlike a smaller company, it would probably take forever to escalate the issue to the right person in LHDN – all this at the expense of the general public because of the bureaucracies in the system.

If I discover a vulnerability in a system, I would blog about it but leave out the details about the exploit itself. At the same time I’ll contact the relevant authorities – and it’s up to them to act.

In the past, have also discovered several vulnerabilities, including one that was developed by a MSC-status company, but I always contacted the PIC first.