4 ms·
Interesting. At least against public companies, this could be a viable alternative for reporting serious issues that aren't taken seriously in said companies' v
by eganist 3y ago
Interesting. At least against public companies, this could be a viable alternative for reporting serious issues that aren't taken seriously in said companies' vulnerability disclosure programs. ("Hey, E Corp clearly knew about this risk")
It might also result in a ton of spam to the SEC and maybe drive companies to close their VDPs if opportunistic bounty kiddies clog the programs with SEC threats over their clickjacking submission.
Interesting indeed. If only for the resulting detritus, at least until any of this ends up in the courts.
- toomuchtodo 3y agohttps://www.sec.gov/tcr https://www.sec.gov/tcr
- PeterisP 3y agoNo, that's not an alternative avenue for reporting serious issues, because that only applies to "material breaches" (i.e. the vulnerability was not only exploitable but actually exploited, and the attack did damage, and the damage is so large that it makes a difference to the financials of the company) so someone has to commit a bunch of felonies before the issue becomes reportable to SEC, and reporting it is not a magic get-out-of-jail-free card. And if some script kiddie in a VDP says "pay me or I'll actually exploit the vulnerability so that it'll be a material breach", well, just sending that message is attempted extortion right there, threatening to commit a felony.
- deleted 3y ago[deleted]