5 ms·
I have received anonymous security notices that suggest we should send money to the "researcher" who wishes to remain anonymous. While I appreciate receiving in
by SquibblesRedux 5y ago
I have received anonymous security notices that suggest we should send money to the "researcher" who wishes to remain anonymous. While I appreciate receiving information on security vulnerabilities, if the person who contacts me remains anonymous then I consider their communication to be a threat and extortion.
If anyone wishes to report a security vulnerability in good faith, and they hope for remuneration of any sort, then they need to identify themselves unambiguously.
- TravisHusky 5y agoI can understand wanting stay anonymous; many companies are hostile towards people who find security vulnerabilities. If they have a real vulnerability and share it I'd accept their request to stay anonymous. If they would not share until I paid, or did something sketchy other than requesting anonymity then I would probably consider it more on the hostile side, but not just because they didn't want to share their true name.