2 ms·
> At what point does “responsible disclosure” allow for going public, even in a limited, non-technical way, for the sake of transparency and user safety Given
by baobun 1y ago
> At what point does “responsible disclosure” allow for going public, even in a limited, non-technical way, for the sake of transparency and user safety
Given context, sounds like you should have gone public half a year ago. Some people think you should to give them a heads up first ("this will go public in 20 days") but this is up to you. At 9 months without follow-up you owe them nothing and it is clear that they are malicious.
- dsekz 1y agoYou can look at my previous answer: > To clarify, If I disclose the exploit publicly, my concern is that the company could take legal action against me, even if I don’t share any technical details or information that would allow someone to reproduce it. – Something I really don't want to deal with.