4 ms·
The difference to me is whether they list all the bugs (while suggesting that their product would help) to the developer before publishing or not. If the only w
by tgb 8y ago
The difference to me is whether they list all the bugs (while suggesting that their product would help) to the developer before publishing or not. If the only way to satisfy them is to pay, then it's incredibly scummy and moreover is a big disincentive for companies to open their source code. After all, every code base has bugs and I'm sure their developers were working on fixing bugs already, but only open source projects can be extorted over their bugs.
- git_son 8y agoDevelopers of the project can write in support and ask for a full log for free.
- zenexer 8y agoIn this case, they shouldn’t have to ask. If you’re going to provide a vulnerability report, provide a vulnerability report. Don’t dance around it to see if you can make money first.
- git_son 8y agoVulnerability is always a Bug. Weakness is always a Bug. Weakness is sometimes a Vulnerability. Bug is sometimes a Weakness and a Vulnerability. Vulnerability != Weakness!