Pay anonymous whitehats for their time or they may come back as blackhats.

Heck, even just perfectly comfortable whitehats will just get fed up with overly onerous reporting requirements and disclose publicly (like here).

▲

lrvick 2 days ago | parent [-]

I have been that guy, after 90 days.

Sometimes I would rather blast a company publicly than have to sign an NDA for an often insultingly low payout.

▲

gchamonlive 2 days ago | parent [-]

You've been that guy allegedly

▲

lrvick 2 days ago | parent [-]

Very publicly so no allegedly to it. Not illegal to disclose vulns publicly, though I wait 90 days after vendor notification based on industry convention.

▲

gchamonlive 2 days ago | parent [-]

I always assume corps would put the full weight of their lawfare regardless of who's right

	▲	lrvick 2 days ago \| parent [-]
		They have tried, and I have laughed at them. "The attorney for the government should decline prosecution if available evidence shows the defendant’s conduct consisted of, and the defendant intended, good-faith security research." https://www.justice.gov/archives/opa/press-release/file/1507...