It is not the whistleblower who should be prosecuted ...

This applies in general — but currently also to security researchers who find and disclose vulnerabilities in IT systems. It is considered good practice to first inform the software manufacturer and give them some time to fix the vulnerability. How much time this takes and whether the company in question is making enough effort to fix the flaw is a matter of opinion.

Six zero-days in six weeks at Microsoft

Microsoft has certainly had its hands full lately patching serious bugs in its software and is not pleased with the publication of evidence regarding unpatched security vulnerabilities. Now the company is even threatening legal action against security researchers. This calls into question the entire community’s willingness to cooperate. Furthermore, lawsuits always attract more attention, making it even more likely that the vulnerability will be exploited by interested parties.

Read more https://www.heise.de/news/Zu-viele-Zero-Days-Microsoft-droht-mit-Gericht-11310723.html

Comment

For further confidential communication, we recommend that you include a reference to a secure messenger, such as Session, Bitmessage, or similar, below the comment text.

To prevent the use of this form by spam robots, please enter the portrayed character set in the left picture below into the right field.