3 ms·
The disclosure timeline section is worth a read of itself: > 2023-11-14 Quarkslab replied to the prior requests and commentary from various vendors as follows:
by filleokus 3y ago
The disclosure timeline section is worth a read of itself:
> 2023-11-14 Quarkslab replied to the prior requests and commentary from various vendors as follows:
Stated that the blog post about the issues would contain the technical report submitted to the disclosure coordination forum and a detailed timeline of the relevant events in the disclosure process. It would include proof-of-concept code to trigger vulnerabilities 1 to 7 but NOT exploit code. Reiterated that the purpose of reporting the vulnerabilities was to help vendors identify and fix them, not to debate about the editorial policies for Quarkslab research work.
- marcus0x62 3y agoPretty typical. Dealing with vulnerability reporting and disclosure has always sucked for researchers, and from my (very) limited experience on the vendor side, it isn't much better there. I'm honestly surprised more of these researchers haven't gone back to the bugtraq/full disclosure model.