> That's how corporations operate in 2022. If you're a journalist from the Washington Post, you might get a three-line statement from a spokesperson. Everyone else gets a canned reply from a bot, or nothing at all.

This is not true, I write to AMD security team for spectre/meltdown/CPU flaws and get reasonable responses. Intel security team is also quite good. The usual wait time is 3-4 days.

Admittedly I do write from my work address.

That's great, but I suspect the address you write from indeed plays a big part here. Direct responses from engineers of that caliber within a matter of days is most certainly not standard.

Probably somewhere in A.A. County.

What’s your work, out of curiosity? I suppose security researcher?

Red Hat Kernel security team.

I answer engineers from other companies all the time but never answer journalists. Engineers give a vibe of “cares about what you do and wants to collaborate”.

Talking to journalists is like talking to the police - as an engineer you don’t understand the situation well enough and you need to involve an (expensive) professional to navigate it.

The question going through my head when I get journalist emails is “can I ignore this and save the hours of work with legal/pr?”.

True that

On most places only the PR team is even allowed to talk to journalists. Exactly because that "is like talking to the police" issue.

It's a very sensible and correct policy.

Thats a good point, I had never thought of that.

> By far the most likely outcome is that they don't even bother responding

So, "likely" the same outcome as when you don't ask, except unlike when you don't ask, there is a different outcome when you do ask? Sounds like you just made the argument in favour of always asking questions.

Under the assumption that time is not valuable. Writing such an email is still an investment of time.