5 ms·

It was 1.5 working days, and there are other factors not mentioned in this article which meant they were lucky to get that (I could write a whole other article

It was 1.5 working days, and there are other factors not mentioned in this article which meant they were lucky to get that (I could write a whole other article about how hostile and dismissive they've been to researchers). If they had requested an extension, I may have considered, but they didn't respond at all. To elaborate, there are no new security disclosures made in this article. The logging issue has already received mainstream media coverage, after they resolved it and published an advisory, and people have been playing with flashing custom roms via mtkclient for months (as referenced in the article). The only new "accusation" is that they are violating GPL. I informally asked them for GPL sources months ago via their community discord server, and I'm aware of others who have asked more formally. Asking for their input on the article was a) giving them a courteous heads-up b) a formality c) an opportunity for them to correct me if they thought I said something untrue.

Arnavion 2y ago
Sure, up to you. In any case I take it they still haven't responded?
- Retr0id 2y ago
  Still no response.
Aurornis 2y ago
> It was 1.5 working days, and there are other factors not mentioned in this article which meant they were lucky to get that In your article you also wrote that you didn’t bother reporting it at all when you first discovered it. Why did you wait until the article was ready to be published to inform them? Standard practice is to inform the vendor early and work with them as you write the article. Keeping the issue quiet and then demanding a rushed response when the article as done isn’t helpful to people who actually want the issue fixed before it goes public. > If they had requested an extension, I may have considered, but they didn't respond at all. Why would they request an extension when they fixed the issue a day before you tried to contact them? They should have written back and pointed you to the already-released security update, but I can also understand why they aren’t thrilled to engage with someone who is trying to make a mountain out of an issue they had already fixed.
- Retr0id 2y ago
  > first discovered it There's more than one issue here, and you're conflating them. IF the logging issue was non-public and non-resolved at the time I wanted to publish my article, I'd probably have given them longer. > Why would they request an extension If they thought 1.5 working days wasn't enough to provide GPL sources, for whatever reason. I don't see how you can argue that 1.5 days is simultaneously too short, and not in need of an extension.
  - fantasybuilder 2y ago
    Your outrage sounds disingenuous. 1.5 days is definitely not a reasonable timeframe for a response to a partially resolved issue. What is 1.5 days in this context? Friday afternoon and Monday? Do you and their security engineers even live in the same time zone?
    - qual 2y ago
      >Your outrage sounds disingenuous. I've read through these comment chains a few times, but I'm having a really hard time finding the "outrage", disingenuous or otherwise. Can you quote the part of the comment that displayed outrage? >Do you and their security engineers even live in the same time zone? Reading through this thread, you can find where the OP says that the time zones were accounted for.
      - Retr0id 2y ago
        This is a symptom of a broader narrative perpetuated the company itself, that any criticism is from "haters".
        fantasybuilder 2y ago
        I know nothing about the product they are selling. As an engineer, I think writing a critical blog post after giving just a 1.5 day notice is bad behavior.
- 2y ago

Arnavion 2y ago

Sure, up to you. In any case I take it they still haven't responded?

Retr0id 2y ago
Still no response.

Aurornis 2y ago

> It was 1.5 working days, and there are other factors not mentioned in this article which meant they were lucky to get that In your article you also wrote that you didn’t bother reporting it at all when you first discovered it. Why did you wait until the article was ready to be published to inform them? Standard practice is to inform the vendor early and work with them as you write the article. Keeping the issue quiet and then demanding a rushed response when the article as done isn’t helpful to people who actually want the issue fixed before it goes public. > If they had requested an extension, I may have considered, but they didn't respond at all. Why would they request an extension when they fixed the issue a day before you tried to contact them? They should have written back and pointed you to the already-released security update, but I can also understand why they aren’t thrilled to engage with someone who is trying to make a mountain out of an issue they had already fixed.

Retr0id 2y ago
> first discovered it There's more than one issue here, and you're conflating them. IF the logging issue was non-public and non-resolved at the time I wanted to publish my article, I'd probably have given them longer. > Why would they request an extension If they thought 1.5 working days wasn't enough to provide GPL sources, for whatever reason. I don't see how you can argue that 1.5 days is simultaneously too short, and not in need of an extension.
- fantasybuilder 2y ago
  Your outrage sounds disingenuous. 1.5 days is definitely not a reasonable timeframe for a response to a partially resolved issue. What is 1.5 days in this context? Friday afternoon and Monday? Do you and their security engineers even live in the same time zone?
  - qual 2y ago
    >Your outrage sounds disingenuous. I've read through these comment chains a few times, but I'm having a really hard time finding the "outrage", disingenuous or otherwise. Can you quote the part of the comment that displayed outrage? >Do you and their security engineers even live in the same time zone? Reading through this thread, you can find where the OP says that the time zones were accounted for.
    - Retr0id 2y ago
      This is a symptom of a broader narrative perpetuated the company itself, that any criticism is from "haters".
      - fantasybuilder 2y ago
        I know nothing about the product they are selling. As an engineer, I think writing a critical blog post after giving just a 1.5 day notice is bad behavior.
2y ago