3 ms·

Could it be that they disclosed it to anyone who was willing to buy their services/sign their contract? They seem to be a business, not some students from acade

• varjag 3y ago
  A very irresponsible business at that.
  • VBprogrammer 3y ago
    I suppose they could have just sold it to the highest bidder.
    • varjag 3y ago
      They probably have sold it to several bidders, the legit kind ones that don't warrant a knock from the Homeland and don't pay in Monero.
• Aachen 3y ago
  That seems very unlikely. As someone in the industry, I haven't heard of commercial businesses doing that, and in fact know of one court case in the Netherlands a handful of years back where someone tried that ("would be a shame if it became public, I could fix if you pay me x") and got sued for extortion (not sure if the phrasing was exceedingly poor but not intended maliciously and the court acquitted, or if they got convicted; there may have been two such cases, one malicious and one not, and I'm mixing them up) My employer (me included) does similar disclosures to vendors and open source projects. Being paid is never a condition for doing responsible/coordinated disclosure. I can't speak for others but, given the extortion allegation risk, I have trouble imagining this is how it went down Much more common is being afraid it leaks due to patches landing too early or people talking, and so limiting it to the biggest vendors out there. In this case, I'd say they could definitely have done more coordinated disclosures without risking that...