this post was submitted on 13 Jun 2026
479 points (99.6% liked)
Technology
85461 readers
3734 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I don't have all the facts but based on the article I don't see the problem everyone seems upset about.
They received the report, decided it was valid but didn't match a bounty. Then asked him to follow standard responsible disclosure processes giving him credit in the final release. All very standard.
Should there have been a bounty? AMD has the budget, probably yes. But nothing in the communications seems any different from what I've seen and have received similar from companies in the past.
Except when he responsibly disclosed to AMD, they closed the ticket as "out of scope" without any further communication. He then made a blog post about it warning other users about the vulnerability since ostensibly, AMD didn't want to fix it. Only after that post had gone viral AMD suddenly came back saying that despite the ticket being closed as such, their internal security team was still analysing it and he should've somehow known that and that he violated the TOC of the bug bounty program (remember, after saying that the vulnerability was out of scope of the program). Additionally AMD then changes those terms a month after the initial ticket to suddenly say that even if the ticket is refused, you're still not allowed to talk about it. Then to top it off they take a month longer to fix it then is industry standard, don't disclose the fix to the researcher as is customary until a few days before release and only because he kept badgering them and as the cherry don't tell their users that the only way to securely fix this is by uninstalling and reinstalling. Everything about it is scummy behaviour all around.