It does harm - it adds 2+ months to the vulnerability window. At the very least you should be sending drafts of the paper out to vendors.
-
No. What helps security is the incentive to disclose. Bug bounties are that of sec res. Top confs are that of academics. With your rationale there would have been no disclosure (finding) at all. If you believe in discl for greater good go tell hackerone and co they’re pointless
What? *Disclosure* helps security. *Incentivizing* that is one step removed from it. The paper is fine. Waiting two months isn't.
-
-
This is all about timelines, not lololol security papers are useless. There are many good ones out there and most talk about vendor response
-
... because their authors were reasonable enough to start the disclosure process in *parallel*, not finish, submit, and wait 2 months!
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.