the 90 day disclosure policy is dead
19 points by fro
19 points by fro
It feels moderately ironic that this article too smells LLM-written
The 'responsible disclosure' policy was always a polite fiction people told each other. It was always a 'go along to get along' kind of situation. LLM-based vuln discovery tools have just exposed it for what it is.
Finally someone exposed social norms for what they really are. Good riddance
Social norms keep society together. Social norms kept people from being at each others' throats when doing vulnerability research, turning natural opponents into people on the same team. Without those norms, any security research that isn't planned by the team doing the work is an unwelcome surprise and the world is worse off for it.