3 ms·
I mean, it's not fair game though. You can release a bug, tell other people how it works, publicly shame the government into having better security. But steali
by ggggtez 8y ago
I mean, it's not fair game though.
You can release a bug, tell other people how it works, publicly shame the government into having better security. But stealing the documents and holding the stolen documents for ransom?
Why should they pay him? He's clearly acting like a criminal, not someone trying to just make a living by making society safer. He's making it worse on purpose because he didn't get his way.
- DyslexicAtheist 8y agoI wasn't saying they should pay him. I don't think they should. But having been on the receiving end of this behavior for far too long my point is that he should be listened to and not ignored like this. It would be OK if it's just ignoring, I've seen companies very eager to use legal threats too especially if the researcher is an isolated individual and not company. It's not too much to ask to have a security@ mailbox and actually pay attention to it. If you don't have a disclosure process in 2019 then there is no reason you should have your systems exposed (whether that's a gov site or company doesn't make a difference) IMHO The moment you answered I was still editing my post trying to point out that I'm not defending him. Sorry if there was an overlap here.