3 ms·
It is absolutely not true that viable commercial vulnerability labs need to "accept the norms around responsible disclosure". There are no such norms. "Responsi
by tptacek 6mo ago
It is absolutely not true that viable commercial vulnerability labs need to "accept the norms around responsible disclosure". There are no such norms. "Responsible disclosure" is an Orwellian term cooked up between @Stake and Microsoft and other large vendors to coerce researchers into synchronizing with vendor release schedules. It was fantastically successful at that, and it's worth pushing back on at every opportunity.
Tavis Ormandy dropped Zenbleed right onto Twitter. He's doing fine. You can blacklist him if you want; I imagine he's not going to notice.
- _yttw 6mo agoYou're right, they don't need to. They have an alternative, to accept what people say or think about them in response. That's what I said.
- expedition32 6mo agoSo how do we feel about Linux distributors who have their heads up their asses and sat on their hands for 30 days?
- SCHiM 6mo agoMicrosoft's policy is: "if you contact us with a vulnerability, you automatically agree to the terms of our responsible disclosure policy", which includes waiting 30 days after patch was created, and says nothing about how long that process takes. There is actually no way to give them a friendly heads up, and then do your own thing. The only way not to be bound is by not sending them any notification at all...
- leni536 6mo agoI wonder if "if you contact us... you automatically agree" stands in court. That's just ridiculous.
- tptacek 6mo agoReader, it does not.
- prmoustache 6mo agoSince no contract is signed, this is just pure fantasy from your part.
- robocat 6mo ago> terms of our responsible disclosure policy I couldn't find a public copy of that. The best starting point I found for reporting vulnerabilities was: https://github.com/microsoft/MSRC-Security-Research/security/policy https://github.com/microsoft/MSRC-Security-Research/security... You can email without agreeing to anything. But for a serious issue Microsoft would obviously try and track down who you are and what jurisdiction you are in.
- SCHiM 6mo agohttps://www.microsoft.com/en-us/msrc/bounty-guidelines https://www.microsoft.com/en-us/msrc/bounty-guidelines > MICROSOFT BOUNTY TERMS & CONDITIONS > Last updated: July 23, 2025 > The Microsoft Bug Bounty Programs Terms and Conditions ("Terms") cover your participation in the Microsoft Bug Bounty Program (the "Program"). These Terms are between you and Microsoft Corporation ("Microsoft," "us" or "we"). By submitting any vulnerabilities to Microsoft or otherwise participating in the Program in any manner, you accept these Terms. Who knows if its enforceable.
- leni536 6mo agoThis seems to be sloppy wording, with the intent of "we only offer the bounty under these terms". Maybe my interpretation is too charitable.
- marshray 6mo agoI do not speak for MSFT, but last time I spoke with MSRC indeed they would be happy to receive your vulnerability report even if you did not wish to participate in any particular bug bounty program.
- robocat 6mo agoSure - that's a bug bounty - which is opt-in. You said "There is actually no way to give them a friendly heads up, and then do your own thing. The only way not to be bound is by not sending them any notification at all..." So what you said is wrong, right.