2026-04-07 11:52 UTC
Companies will put up all kinds obstacles to responsible disclosure for researchers to get around to make their own lives easier. But they often forget that in the end it is researcher who calls the shots. It is the researchers vuln and they can do whatever they want with it.
https://www.bleepingcomputer.com/news/security/disgruntled-researcher-leaks-bluehammer-windows-zero-day-exploit/#comments
#vulnerability #disclosure #responsibledisclosure #windows #microsoft
Replies (1)
-
@Lee_Holmes@infosec.exchange 2026-04-07 17:32
@spacerog I agree with your point in general. It's odd that you're using a Microsoft case as the example. Microsoft was among the first companies to push for not calling it "Responsible Disclosure" for exactly the reason you point out. https://www.microsoft.com/en-us/msrc/blog/2010/07/coordinated-vulnerability-disclosure-bringing-balance-to-the-force For this specific case, who knows where the difference of opinion was - the github is super low on details.