Heck, even just perfectly comfortable whitehats will just get fed up with overly onerous reporting requirements and disclose publicly (like here).

▲

lrvick 2 days ago | parent [-]

I have been that guy, after 90 days.

Sometimes I would rather blast a company publicly than have to sign an NDA for an often insultingly low payout.

▲

gchamonlive 2 days ago | parent [-]

You've been that guy allegedly

▲

lrvick 2 days ago | parent [-]

Very publicly so no allegedly to it. Not illegal to disclose vulns publicly, though I wait 90 days after vendor notification based on industry convention.

▲

gchamonlive 2 days ago | parent [-]

I always assume corps would put the full weight of their lawfare regardless of who's right

	▲	lrvick 2 days ago \| parent [-]
		They have tried, and I have laughed at them. "The attorney for the government should decline prosecution if available evidence shows the defendant’s conduct consisted of, and the defendant intended, good-faith security research." https://www.justice.gov/archives/opa/press-release/file/1507...