Informing a Company of a Security Discovery?

Posted by ryuzaki0 on Friday November 3, 2006 @05:45PM from the don't-shoot-the-messenger dept.

An anonymous reader asks: "I recently found a major security flaw through serendipitous independent research. I do not want to go into details, but it could be used against certain companies and have a large negative financial impact. However, I have no wish to use this for malicious purposes, and would rather profit by helping the company fix the problem. Seeing as many researchers have been persecuted/prosecuted lately for public disclosure, what is the best way to go about informing the company and agreeing on an appropriate fee for my services, without having it look as though I am trying to extort them?"

Slashdot Mirror

Informing a Company of a Security Discovery?

1 of 102 comments (clear)