3 ms·
Giving the vendor a deadline up front is coordinating with the vendor. You brought them in on a plan for what you’re going to do and asked them to take actions
by akerl_ 1y ago
Giving the vendor a deadline up front is coordinating with the vendor. You brought them in on a plan for what you’re going to do and asked them to take actions as part of that plan.
- Dylan16807 1y agoReporting the bug to the vendor is coordinating in a weak sense, but you're not coordinating the disclosure unless they have input in how the disclosure happens. If an email asking them to fix it qualifies as coordinated disclosure, then an immediate public post about the bug is also coordinated disclosure. It also brings them in and asks them to take actions.
- tptacek 1y agoEven "responsible disclosure" didn't necessarily give vendors input into "how" the disclosure happened, only "when".