Comment on What to do when a company refuses to fix a vulnerability I disclosed to them?parentComments−tptacek14yIf you tell them that unless they pay you or retain you as a contractor by a certain date that you'll publish, you are in fact extorting them.People who have found vulnerabilities and also been naive about the law have run aground on this before.−huhtenberg14yDo you have any examples?−tptacek14yI'm worried that if I start Googling this I'll lose a couple hours of my day to a "researching vulnerability extortion" jag.
Comments
If you tell them that unless they pay you or retain you as a contractor by a certain date that you'll publish, you are in fact extorting them.
People who have found vulnerabilities and also been naive about the law have run aground on this before.
Do you have any examples?
I'm worried that if I start Googling this I'll lose a couple hours of my day to a "researching vulnerability extortion" jag.