4 ms·
You're right - I don't think you qualify for a bounty if you write a blog post and then the team contacts you. Usually there are strict requirements including a
by cddotdotslash 13y ago
You're right - I don't think you qualify for a bounty if you write a blog post and then the team contacts you. Usually there are strict requirements including a responsible disclosure to the company directly.
- x0x0 13y agoplease don't parrot nonsense like "responsible" disclosure; it mangles language to normalize behavior these companies want (what's the opposite of responsible? Not letting companies sit around and procrastinate while users are or may be being exploited is therefore irresponsible.) I'm not necessarily saying people shouldn't disclose first, but labeling it as responsible is grating.
- icelancer 13y ago>I'm not necessarily saying people shouldn't disclose first, but labeling it as responsible is grating. Absolutely. That kind of language marginalizes people who are public whistleblowers who have no faith in the internal systems in which they reside.
- tptacek 13y agoI loathe the term too, but am steeling myself to concede it, since it's rapidly becoming an industry standard.
- pgeorgi 13y agoso it's optimistic disclosure? assume that the vendor will respond responsibly.
- eru 13y agoHow about private (or partial) disclosure? As opposed to just `disclosure', or public disclosure.
- jwcrux 13y agoYou don't if you disclose it before reporting it. This is why I was so impressed. The contacted me after I published the post, and yet they still sent me a token of their appreciation. That to me showed a ton of class.