If they want to take advantage of disclosure for marketing, they're either going to need to accept the norms around responsible disclosure, or they're going to need to accept how shirking those norms will come off. That's life in society. Sometimes it's annoying and sometimes it doesn't feel rational, but these norms have been negotiated throughout the history of our industry and are the way they are for reasons good and bad.

I just don't see the point in complaining about how shirking the norms of your industry will make you look irresponsible. I don't really care that they could have decided to sell the vulnerability instead. It isn't material.

▲

tptacek 5 hours ago | parent | next [-]

It is absolutely not true that viable commercial vulnerability labs need to "accept the norms around responsible disclosure". There are no such norms. "Responsible disclosure" is an Orwellian term cooked up between @Stake and Microsoft and other large vendors to coerce researchers into synchronizing with vendor release schedules. It was fantastically successful at that, and it's worth pushing back on at every opportunity.

Tavis Ormandy dropped Zenbleed right onto Twitter. He's doing fine. You can blacklist him if you want; I imagine he's not going to notice.

▲

SCHiM 5 hours ago | parent | next [-]

Microsoft's policy is: "if you contact us with a vulnerability, you automatically agree to the terms of our responsible disclosure policy", which includes waiting 30 days after patch was created, and says nothing about how long that process takes.

There is actually no way to give them a friendly heads up, and then do your own thing. The only way not to be bound is by not sending them any notification at all...

▲

prmoustache 2 hours ago | parent | next [-]

Since no contract is signed, this is just pure fantasy from your part.

▲

leni536 4 hours ago | parent | prev [-]

I wonder if "if you contact us... you automatically agree" stands in court. That's just ridiculous.

	▲	tptacek 4 hours ago \| parent [-]
		Reader, it does not.

▲

_yttw 5 hours ago | parent | prev [-]

You're right, they don't need to. They have an alternative, to accept what people say or think about them in response. That's what I said.

	▲	expedition32 15 minutes ago \| parent [-]
		So how do we feel about Linux distributors who have their heads up their asses and sat on their hands for 30 days?

▲

selectively 5 hours ago | parent | prev [-]

Those norms do not exist. Those are people asking companies to do stuff to benefit the person complaining for free, and many companies will not do that.

▲

_yttw 5 hours ago | parent [-]

It seems to me you're unaware of them, but there are strong norms around disclosure. They've been discussed for decades. It is the expectation that vendors would be notified in a scenario like this.

▲

selectively 5 hours ago | parent [-]

No, there are users who want those to be norms. Qualified researchers happily sell substantive vulns to people who pay (Governments/Cellebrite and companies like that) enough to quell any complaint.

	▲	_yttw 5 hours ago \| parent [-]
		Which is again, irrelevant to the question of how disclosure works and what expectations there are around it because that is not disclosure and is not what was being discussed.