I'm so sick and tired of some companies that any vulnerability I find in their products going forward is an immediate public disclosure. It's either that or no disclosure, and it would be irresponsible not to disclose it at all.

Cracked a thrift store IoT medical device. Contacted vendor. They sent me a one way NDA. Lol no.

The platform knows my identity, publishing the details would be against their terms, there's an implied threat that they could take legal action against me if I published the details, and they even low-balled the severity to avoid paying out the appropriate amount. Awesome experience overall.

I'm not suggesting in this thread that coordinating with vendors is bad. I'm suggesting that to frame any non-coordinated disclosure as inherently irresponsible is bad, and that is what is implied when we use the label "responsible disclosure" for "coordinated disclosure".

Maybe things are better now.

Years ago the only contact for many companies was through customer service. "What do you mean you're in our computer? You're obviously on the phone!"

Doing the right thing can be awfully unpleasant.

Near the bottom of the blog post it says:

> When | What Happened

> Day 1, same day | RBI fixes everything faster than you can say "code red"

> Credit where it's due – RBI's response time was impressive.