4 ms·
It is common practice to give the company sufficient time and communicate, and then release the details once the vulnerability is patched. But it’s also common
by darth_avocado 1y ago
It is common practice to give the company sufficient time and communicate, and then release the details once the vulnerability is patched. But it’s also common in practice to disclose the vulnerability after a set period of time if the company does not engage in any form of communication and refuses to patch the vulnerability. In this case they didn’t engage in any form of communication and then partially patched the problems. Nothing out of the ordinary here.
- eclipticplane 1y agoWhat _isn't_ common practice is actually copying and posting company material on your blog. Just because a door is unlocked does not give you the right to take materials & post them.
- 93po 1y agoThis requires you to have any amount of respect for intellectual property, which many find to be immoral
- none_to_remain 1y agoI have seen this in practice for vulnerabilities that affect many users of some software. If some Hackermann finds that Microsoft Windows version X or Oracle Database server version Y has a security flaw then disclosure is virtuous so that people using those can take measures. That reasoning doesn't seem to apply here.