3 ms·
An 11 month embargo for a widespread security flaw like this is unacceptable. Researchers need to refuse to comply with this. 90 days by default and an extra 90
by driverdan 7y ago
An 11 month embargo for a widespread security flaw like this is unacceptable. Researchers need to refuse to comply with this. 90 days by default and an extra 90 on request is more than enough. If they can't get their shit together in six months they won't be able to in 12.
- 3pt14159 7y agoWe need an industry standard shut-up-and-pay-me system. First 90 days free. Then some sort of quadratic formula for every month after that.
- yjftsjthsd-h 7y agoI'd prefer 90 days and then unconditional publishing. I grant that making companies' desire for silence actually affect the bottom line has appeal, but 1. some companies have deep pockets, and 2. I'm not ethically comfortable with anything of the form "pay me to not disclose this bad thing".