Hacker News

points by phyzome 1 day ago | 0 comments

Heck, even just perfectly comfortable whitehats will just get fed up with overly onerous reporting requirements and disclose publicly (like here).

[–] lrvick 1 day ago

I have been that guy, after 90 days.

Sometimes I would rather blast a company publicly than have to sign an NDA for an often insultingly low payout.

[–] gchamonlive 1 day ago

You've been that guy allegedly

[–] lrvick 1 day ago

Very publicly so no allegedly to it. Not illegal to disclose vulns publicly, though I wait 90 days after vendor notification based on industry convention.

[–] gchamonlive 1 day ago

I always assume corps would put the full weight of their lawfare regardless of who's right

[–] lrvick 1 day ago

They have tried, and I have laughed at them.

"The attorney for the government should decline prosecution if available evidence shows the defendant’s conduct consisted of, and the defendant intended, good-faith security research."

https://www.justice.gov/archives/opa/press-release/file/1507...