What a maintainer's disclosure inbox already knows about the question the EU Cyber Resilience Act is about to ask every software vendor.
Written by: Shane Warden, Principal Architect, ActiveState
Last year, someone submitted a vulnerability report to a security address for a free software project I help to review. The report followed our reporting guidelines, with a GPG signature and proper responsible disclosure ceremony, addressed only to the people who should have seen it.
It contained 95 vulnerabilities, purportedly. We took it seriously, because that security process exists for exactly this reason.
Yet something felt off, because how many human security researchers would compile a list 95 long and keep going instead of stopping at three or four and asking for a longer engagement.
Two or three of the 95 turned out to be real. That's a low percentage, and it didn't matter, because we still had to work through all 95 to find the two or three that did. Then came the second email: pay $100,000, or the report would go public with Heartbleed-style press.
The report itself was inflated. The threat behind it was not, because the blast radius of a disclosure like that is every deployment of the affected software an attacker can find by scanning the open internet for who's still running it.