3 ms·
The timeline for disclosure is set by the reporter, no? "We will disclose this bug on YYYY-MM-DD". The other side can ask for an extension, but has no intrinsic
by jsnell 5y ago
The timeline for disclosure is set by the reporter, no? "We will disclose this bug on YYYY-MM-DD". The other side can ask for an extension, but has no intrinsic right to one. Unless I am missing something, this has nothing to do with PZ, so their default timeline is totally irrelevant.
- Cthulhu_ 5y agoI believe PZ can set the terms of reasonable disclosure (and the like) as a condition for paying out.
- manquer 5y agoDepends on if you want to get paid. Many organizations will not pay bug bounties if you disclose before they fix or without their consent. Project Zero probably doesn't care or doesn't even accept the bounties
- jsnell 5y agoThe post had no indication of a bounty being held hostage. From https://www.google.com/about/appsecurity/reward-program/ https://www.google.com/about/appsecurity/reward-program/ it seems like the requirement for a bounty is not for "don't disclose before fix is released", but "don't disclose without reasonable advance notice". So I just don't see the inconsistency here. Project Zero gives a disclosure deadline. The reporter here chose not to give one. When they said they wanted to disclose, there was no stalling for extra time. Just what is the expectation here?