3 ms·
I've done responsible disclosure myself. But I wouldn't dunk on a vendor for not telling me they released a fix on the same day because I'd probably just assume
by _cenw 3y ago
I've done responsible disclosure myself. But I wouldn't dunk on a vendor for not telling me they released a fix on the same day because I'd probably just assume it's internal communication issues. And then attribute their late publishing of associated CVEs to my threats. It all feels a bit petty and rushed (to get the credit?) to me. Especially if a fix it cut into a regular release and not a hotfix, it likely just made it in by accident.
- bitexploder 3y agoI would reserve judgment until seeing everything. I am just advocating from the general perspective of a security firm. I ran one for a decade and disclosed a lot of vulns. My experience was almost always that vendors were the ones creating issues. We tried our best due to how sensitive issues can be and viewed each vendor or company as a potential customer. Rapid7 could have easily been rude or unreasonable, but that is not the norm for sure. It probably was a little petty, but we don’t know what the lead up was either. You just get tired of being jerked around as a security firm when you do this a lot.