How NOT to handle responsible disclosure

Waaaaay back in 2015, the CSO of Oracle wrote a scathing blog post on vulnerability disclosure. Her message was that security researchers were in violation of the Oracle license agreements if they filed security vulnerabilities back to Oracle. The reasoning was that running binary analysis tools against Oracle products shipped to customers was reverse compilation and breached the TOS. She went on to say that Oracle does all their own scanning and that customers should focus on their own security …

cybersecurity disclosure responsible responsible disclosure