Everything Old Is New Again: Legal Restrictions on...
summary
Argues that many public bug-bounty and VDP platforms contractually force non-disclosure clauses that bar researchers from sharing findings, citing live examples (Amazon, T‑Mobile, Citigroup via Bugcrowd/HackerOne) and counterevidence like Project Zero 90-day policy showing deadlines speed fixes. Shows harms: silencing labor discussion, chaining safe‑harbor loss across platforms, and jeopardizing conference or academic obligations. Offers concrete remedies: audit VDP terms, prefer direct reporting channels, refuse indefinite NDAs, push platforms to ban mandatory perpetual non‑disclosure and adopt clearer safe‑harbors.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:32Legal restrictions on disclosure
- 3:00Vulnerability disclosure debates
- 8:35Coordinated disclosure and bounties
- 11:23Responsible disclosure in 2025
- 15:57NDAs and disclosure problems
- 20:30Improving disclosure practices
- 23:41Modern responsible disclosure
related talks
48mThe Law and Economics of Bug Bounties
51mBug Bounty: Keeping Hacks Ethical in 2022
33mHacking the Law: Are Bug Bounties a True Safe Harbor?
27mHacker Rights
42mKeynote: Hacking Policy and Policy Hacking - A Hacker Guide to...
36mKeynote: We Deserve Rights
58mPanel Discussion - The Risks of Requiring Premature Vulnerability Disclosures
50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual Temptation