9 ms·

Google is punishing Epic for communicating. Had Epic silently released the patch and not responded to the thread they could have gotten more time to patch. That

• PeterisP 8y ago
  If Epic had silently released the patch and not responded to the thread, that would be irresponsible and unethical, be harming the security of their users and be spitting in the face of the responsible disclosure community - that's something that you can do once, demonstrating to the world that they explicitly refuse responsible disclosure and every security researcher should publish Epic's vulnerabilities immediately without notifying Epic first. And it's not like they would have succeeded - you can't patch something silently, if you know of a vulnerability it's not that hard to verify if it has been fixed in every upcoming version or not. Google would have had noticed that within a day anyway and (with justification) disclosed the vulnerability right then and there, instead of giving them those 7 extra days.