Re:Steam Windows Client Local Privilege Escalation 0day
by SpicyLemonZest on Wednesday August 07, 2019 @04:26PM
(#20638589)
It'd be like writing public articles attacking your company's accounting practices. Sometimes things are so bad it's fair to blow the whistle, but it creates nasty incentives if companies can't perform private security investigations without risking a public shaming over the results.
Re:Steam Windows Client Local Privilege Escalation 0day
by gtirloni on Wednesday August 07, 2019 @09:55PM
(#20641123)
These people are not employees. They don't agree to amounts before starting the work. They don't make promises. Nothing! I don't see how someone publishing something in that situation is a problem.
Like OP wrote in this thread, it either is a vulnerability or it's not. In the latter case, just assume it's the cost of doing business and people will write "bad" things about your product?
Re:Steam Windows Client Local Privilege Escalation 0day
by FDSGSG on Wednesday August 07, 2019 @03:59PM
(#20638289)
An NDA is always involved. And even if not, badmouthing your customers is bad business.
Unless the company is lying and it IS a real vulnerability, writing an article about it seems harmless to me.
OFC that if I planned on writing an article I'd be open about it beforehand, but that feels like a courtesy and not an obligation unless an NDA is involved.
Disclaimer: I don't work in security so this is purely curiosity.