4 ms·
A government should have a formal response, not a joke. It downplays the work of the hacker and the severity of the issue.
by stabbles 2y ago
A government should have a formal response, not a joke. It downplays the work of the hacker and the severity of the issue.
- voidUpdate 2y agoThe letter was the formal response
- jeroenhd 2y agoThis is the formal response, in accordance with the procedure documented on the website: https://english.ncsc.nl/contact/reporting-a-vulnerability-cvd https://english.ncsc.nl/contact/reporting-a-vulnerability-cv... There's also more to the process than just sending a shirt. > * If you submit your report in accordance with the procedure, then there will be no grounds for legal consequences in relation to your report. We will handle your report in confidence and we will not share your personal details with third parties without your permission unless we are compelled to do so by law or by a court ruling. > * We will only specify your name as the discoverer of the vulnerability in question if you give permission for us to do so. > * We will confirm receipt of the report within one working day and we will subsequently send an assessment of your report within three working days. We will also give you progress updates regarding the resolution of the problem. > * The NCSC will strive to have the the security problem identified by you resolved within no more than 60 days. Upon resolution of the problem, we will consult with you to determine whether and in what way to publish details of the problem and its resolution. > * The NCSC will also offer a reward to thank you for your help. This reward can vary from a T-shirt to gift certificates depending on the severity of the security problem and the quality of the report. To be eligible for a reward, the report must concern a serious security problem that is as yet unknown to the NCSC.