4 ms·
Meaningful or not, some companies and organizations don't understand the difference between a CVSS score of 2.0 and 10.0. Being in the cybersecurity industry my
by tkems 3y ago
Meaningful or not, some companies and organizations don't understand the difference between a CVSS score of 2.0 and 10.0. Being in the cybersecurity industry myself, there is a wide gap of knowledge in the risk of vulnerabilities. Following a some-what standard way of reporting vulnerabilities is well documented. Begging for a bounty is not standard.
I also think that is perfectly fine to document the process in public so that everyone is informed.
Also, in regards to your comment on meaningful payouts, you could make the same argument for spam email. Occasionally it works for people in developing countries is, in my opinion, a terrible argument for allowing such behavior.
- lapinot 3y ago> Occasionally it works for people in developing countries is, in my opinion, a terrible argument for allowing such behavior. I think the point GP was raising isn't that it's ok, but that it's part of a wider problem and isn't just happening because people are stupid. It makes sense for them because of how the world economy is currently set up. Saying "hey will you just stop please" won't change that fact. Exactly the same thing is true for spam.