3 ms·
> I do security for a living, this is exactly how I'd have handled it and how responsible disclosure is supposed to work. Assuming you're in the USA (might be
by aahortwwy 5y ago
> I do security for a living, this is exactly how I'd have handled it and how responsible disclosure is supposed to work.
Assuming you're in the USA (might be an incorrect assumption) I'd strongly recommend familiarizing yourself with the CFAA and how "improper access to a computer" has been legally interpreted.
- Aachen 5y agoI've familiarized myself with the relevant computervredebreuk legalese and read that our public prosecutor doesn't prosecute cases where all the responsible disclosure guidelines were followed. (Of course they'll still check that they were, since not every claimed white hat is truly a white hat.)
- aahortwwy 5y agoOther jurisdictions are not so sensible.
- erosenbe0 5y agoThese cases of just crossing the threshold are not that interesting to prosecutors unless affecting some company with a lot of political capital. If there is no restitution, no safety implications, no children harmed, and the case is a bit confusing, why take it? Prosecutors prefer to take the slam dunk cases where any normal person can agree it was an intrusive or fraudulent access.