← Back to context

Comment by JumpCrisscross

1 month ago

> Distribution of 0day for lulz has been criminal since 2022

Skimmed the article. Not seeing it support your claim.

9 comments

JumpCrisscross

Reply
1970-01-01  1 month ago

Responsible disclosure is a normalized process in the courts. Skipping it opens you to, at very minimum, a plethora of civil lawsuits, including any and all the damages that resulted from skipping it. The odds are very much not great that you'll be OK.

  • JumpCrisscross  1 month ago

    Civil, sure. The dispute is over criminal jurisdiction.

    • dghlsakjg  1 month ago

      Is there actually a civil duty of care here?

      Responsible disclosure is an industry norm, but I don't really see how an independent researcher has a legal obligation to play by industry norms. If I discover that any product has a defect, I am free to blab about it all I want as long as it is truthful. There may be considerations beyond this if you are disclosing something discovered by breaking terms of service or by fucking with a computer that isn't yours, but discovering that your copy of windows on your machine has a flaw and telling people about it is protected.

      2 replies →

    • 1970-01-01  1 month ago

      The dispute is whether or not it is perfectly legal free speech. By simply publishing it on GitHub, it was a violation of a TOS and that right there opens it up to lawsuits from MS. You are free to go down this path and prove me wrong.