News for hackers. Stuff that matters.
Re:Ridiculous vulnerability disclosure process with CrowdStr... by thaeli on Monday August 22, 2022 @02:28PM (#32555283)
The only reason it's a "thing" is that the reporters in this case were attempting to do a responsible, coordinated disclosure. That's important for their own brand - many clients would be reluctant to hire a security consultant who just dropped 0days without a damn good reason. So this is documentation and justification for why they did a unilateral disclosure - the expectation is that you "show your work" and be clear that you tried to work with the vendor and they wouldn't work with you in good faith so you had no choice but to unilaterally disclose.
Re:Ridiculous vulnerability disclosure process with CrowdStr... by tptacek on Monday August 22, 2022 @04:25PM (#32556735)
Nobody is going to avoid hiring a security consultancy that posts bugs with a coordinated timeline that notes they didn't engage with the bounty program.