4 ms·
> fine - that's now on them Is that legally true? The legal risk of having published this without responsible disclosure vanishes if the conventional period of
by hunter2_ 2y ago
> fine - that's now on them
Is that legally true? The legal risk of having published this without responsible disclosure vanishes if the conventional period of opportunity is ignored? That smells fishy.
- loktarogar 2y agoI'm not a lawyer so I'm not speaking to the legality of this. Legality is not the only thing that matters. If you publish an exploit without at least making an attempt to fix it, and someone follows you and exploits it, then there's a direct moral line between you and that exploitation. They more likely than not wouldn't have exploited it without you putting that published info in their path. It's now on you, them and the company, morally. Any damages that result from this interaction are because you and the company enabled them to happen. That's different to someone else stumbling on it and exploiting it. That's purely on the company and the exploiter.