6 ms·
I think very few people would consider that to be responsible disclosure. The common practice is to allow 90 days as a minimum.
by MatthewWilkes 3mo ago
I think very few people would consider that to be responsible disclosure. The common practice is to allow 90 days as a minimum.
- rustyhancock 3mo agoI think I'd personally develop a minimal patch and then publically disclose. I'm not sure it's be reasonable to leave an actively exploited critical bug until August. Nor would I be too interested in playing middle man or paying for support from curl to get it out.
- zamadatix 3mo agoDisclosing an actively used exploit is is usually not treated the same as a typical vulnerability report.
- akerl_ 3mo agoReminder that what you're describing is "coordinated disclosure", and that there are in fact plenty of people who consider "full disclosure" to be preferable in some or all cases.