5 ms·

How do companies still think it's acceptable to ignore responsible disclosure in the hopes the problem just goes away? Even companies with the most automated n

by cube00 5y ago

How do companies still think it's acceptable to ignore responsible disclosure in the hopes the problem just goes away? Even companies with the most automated non-existent customer service know they need to provide separate channels for legal and security so that actually get read by a human.

vmception 5y ago
wait this is an argument in favor of the practices that are currently called responsible disclosure? somebody NFT this post
dspillett 5y ago
It could be user or system or prices error rather than malice in this case: the message not getting to the right person (general mail fail, people monitoring that target being unavailable, misidentification as junk, ...) or that person/group missing it assist a sea of other comms. We don't know how much effort was made to chase a response. Their response after the issue hit social media was far more decent than companies have done in the past: > I would like to update that I have been reached out by @Razer and ensured that their security team is working on a fix ASAP. Their manner of communication has been professional and I have even been offered a bounty even though publicly disclosing this issue.
- dspillett 5y ago
  “Prices” should have been “policy” there. Also, “assist” → “amongst”. Darned auto-carrot strikes again, and I was far too late noticing to be able to edit. Two in a short post, I'm not sure if the slide-keyboard is getting worse over time or my coordination is failing as I age but something seems to be failing more these days than it used to…
andix 5y ago
They probably just don't read their emails or messages. Maybe customer support agents are just very badly trained. Or there is a second/third/forth level that investigates those emails, but they are getting too many messages to go through all of them.
mhh__ 5y ago
Because it would mean spending money and the buck stopping somewhere other than the void.
vmception 5y ago
> How do companies still think it's acceptable to ignore responsible disclosure in the hopes the problem just goes away? its not responsible to disclose in secret and hope the company doesn't ignore you or curb stomp you to oblivion its not responsible to push for a little pat on the back and maybe an undervalued $ compensation proverbially nuke them from orbit, responsible is not a factor here

by cube00 5y ago

vmception 5y ago

wait this is an argument in favor of the practices that are currently called responsible disclosure? somebody NFT this post

dspillett 5y ago

It could be user or system or prices error rather than malice in this case: the message not getting to the right person (general mail fail, people monitoring that target being unavailable, misidentification as junk, ...) or that person/group missing it assist a sea of other comms. We don't know how much effort was made to chase a response. Their response after the issue hit social media was far more decent than companies have done in the past: > I would like to update that I have been reached out by @Razer and ensured that their security team is working on a fix ASAP. Their manner of communication has been professional and I have even been offered a bounty even though publicly disclosing this issue.

dspillett 5y ago
“Prices” should have been “policy” there. Also, “assist” → “amongst”. Darned auto-carrot strikes again, and I was far too late noticing to be able to edit. Two in a short post, I'm not sure if the slide-keyboard is getting worse over time or my coordination is failing as I age but something seems to be failing more these days than it used to…

andix 5y ago

They probably just don't read their emails or messages. Maybe customer support agents are just very badly trained. Or there is a second/third/forth level that investigates those emails, but they are getting too many messages to go through all of them.

mhh__ 5y ago

Because it would mean spending money and the buck stopping somewhere other than the void.

vmception 5y ago

> How do companies still think it's acceptable to ignore responsible disclosure in the hopes the problem just goes away? its not responsible to disclose in secret and hope the company doesn't ignore you or curb stomp you to oblivion its not responsible to push for a little pat on the back and maybe an undervalued $ compensation proverbially nuke them from orbit, responsible is not a factor here