2 ms·
Tuesday, January 14th 2020 - Initial Discovery Tuesday, January 14 2020 - Tweet sent attempting to establish communications with Netgear Wednesday,
by politelemon 7y ago
Tuesday, January 14th 2020 - Initial Discovery
Tuesday, January 14 2020 - Tweet sent attempting to establish communications with Netgear
Wednesday, January 15 2020 - Reached out to Bugcrowd to attempt to establish communications.
Thursday, January 16 - Bugcrowd responds, but we are unable to establish a communications channel outside of the Netgear bug bounty programs.
Friday, Jaunary 17th - Conversation with bugcrowd proves inconclusive
Sunday, January 19th - Feeling we have exhausted our disclosure avenues, we decide to publish
I didn't understand, can someone explain this to me - I see the author tried to talk to Netgear, then it's BUgcrowd the next day... it's not clear to me what the relation between Netgear and Bugcrowd is.
- Maxious 7y agoBugcrowd run bug bounty programs like https://bugcrowd.com/netgear https://bugcrowd.com/netgear on behalf of companies They explained earlier that if they entered the bug bounty program with Netgear, they would be agreeing to not disclose: "By submitting the security bug, you affirm that you have not disclosed and agree that you will not disclose the security bug to anyone other than NETGEAR." So it seems they were trying to get Bugcrowd as a intermediary to contact Netgear on their behalf to "establish a communications channel outside of the Netgear bug bounty programs"
- politelemon 7y agoThanks for the explanation!