News for hackers. Stuff that matters.

A comment on Ask HN: How do I go about responsibly disclosing security vulnerabilities?.

Re:Ask HN: How do I go about responsibly disclosing security... by Mithaldu on Sunday July 05, 2015 @04:13PM (#9834743)
TLDR: Talk to a lawyer.

Also: https://www.eff.org/issues/coders/vulnerability-reporting-fa...

--

It depends on whether they already know who you are. If you've managed to remain completely anonymous, you can pressure them much easier since they can't retaliate with legal repercussions.

If they know who you are especially, but generally as well, i recommend talking to a lawyer.

Edit: Removed bit about phone/email. Good point.

vvvv

[ Parent | on HN ]
Re:Ask HN: How do I go about responsibly disclosing security... by tptacek on Sunday July 05, 2015 @04:43PM (#9834866)
The lawyer is going to tell you not to negotiate with vendors on the phone; you want documentation of the back-and-forth.
[ Parent | on HN ]
Re:Ask HN: How do I go about responsibly disclosing security... by skeoh on Sunday July 05, 2015 @06:55PM (#9835445)
Good advice to follow for all important communication.
[ Parent | on HN ]