4 ms·
That's not much leadtime to patch --but they have a point in that JB did not coordinate with them. To me it still looks spiteful on R7's side and irresponsible
by mc32 3y ago
That's not much leadtime to patch --but they have a point in that JB did not coordinate with them. To me it still looks spiteful on R7's side and irresponsible on JBs part as well as R7s part. They both are guilty of not having proper communication to reach a mutually agreeable result.
It looks bad. R7 is making the other guy JB look less bad with the way they went about this. They both could have handles this better --but ultimately it looks worse for R7 from my PoV.
- ziddoap 3y agoI understand your point of view, but this is pretty much all on JBs part in my opinion. They say as much in a recent blog post. >At this point, we made a decision not to make a coordinated disclosure with Rapid7 >We published a blog post about the release. This blog post intentionally didn’t mention the security issues in detail These points would have triggered Rapid7s silent patching policy, which would have sped up the entire timeline and lead to the current state of affairs. I don't consider that to be spiteful (the policy is out in the open, JB knew what they were doing and knew the consequences of not coordinating any longer), but that's just me.