3 ms·
> I [showed] that the timer mitigation would not stop these vulnerabilities Yes, that was obvious to people with some background in this class of attacks. Good
by JoachimSchipper 9y ago
> I [showed] that the timer mitigation would not stop these vulnerabilities
Yes, that was obvious to people with some background in this class of attacks. Good on you for figuring that out independently (seriously!), but you're not going to get a bounty for something widely known.
- WebLLL 9y agoOk, but if a working web browser POC is not worthy of a bug bounty reward, because they claim to already know, then what is the point of the bug bounty? Why are they not just paying for specialists to advise them on how to fix this if they have no plan. They don't even listen when you try and try and try to explained what needs to be done. How can a bug bounty fix this?
- tgb 9y agoThe point is that the vendor was claiming they had patched the flaw. They can't simultaneously claim to have a patch and that they know the patch doesn't fix it.