Hacker News

points by lrvick 1 day ago | 0 comments

I have been that guy, after 90 days.

Sometimes I would rather blast a company publicly than have to sign an NDA for an often insultingly low payout.

You've been that guy allegedly

Very publicly so no allegedly to it. Not illegal to disclose vulns publicly, though I wait 90 days after vendor notification based on industry convention.

[–] gchamonlive 1 day ago

I always assume corps would put the full weight of their lawfare regardless of who's right

[–] lrvick 1 day ago

They have tried, and I have laughed at them.

"The attorney for the government should decline prosecution if available evidence shows the defendant’s conduct consisted of, and the defendant intended, good-faith security research."

https://www.justice.gov/archives/opa/press-release/file/1507...