Yep. Stating Github and providing a non existent Github link is a serious redflag which brings trust issues.
Either provide the Github (for whatever reasons) or remove the link from your website. I am assuming it is closed source.
Personally I don't trust new VPN solutions without published source code!
Alternatives: Tailscale with Headscale or better Self-hosted Netbird if one is a itty-bitty IT savvy.
Netbird (self-hosted) offers a lot lot more with the self-hosted solution.
- SSO
- Independent networks
- Superb policies / ACLs
- Keybased onboarding
- auto-expiration and a lot more like integrations and what not!
Tough to beat the Netbird Open source offering if one tends to spent a little time and effort (though not everyone's cup of coffee!)
Such can look at tailscale's offering since the free version of Tailscale offers more than what is offered here and all the client applications are open source and constantly updated.
If pricing is going to the only difference, (at a high level, everything under the hood looks similar - wireguard based, zero config, p2p mesh, port forwarding etc etc.,) bring a lot more trust by offering an open source version like others.
I would suggest to add some money into the account if you are not going to monitor the emails. I have a lot of domains with Namecheap and I've always for plenty of reminder mails from them about expiry.
For me, it looks like the problem is between the keyboard and the chair and not otherwise. Fix the emails and avoid future issues. Namecheap has been one of the best domain providers period.
I have had plenty of bad experiences and predatory and opportunistic billing with plenty of others.
I have been dealing with domains since the early network solutions days (I would comfortably say that it my experience is close to 30+ years and Namecheap as a domain provider is at the top of my list!).
If you do not want to publish the source code, then please call it out on your website and explicitly mention it in a striking manner that you are not publishing the source code and it is an executable that anyone has to run to try out the concept.
Let people figure out how to make use of it. Thanks.
That output doesn't look like "without any issues" to me...
Thought the problem of LLMs being incapable of basic arithmetic had been solved a while back by teaching them to treat arithmetic as inputs to (e.g.) a Python interpreter
This is exactly how bug bounty hunters are being exploited for.
Though it is on the good side about disclosure, calculate how much financial, reputation impact, negative publicity would cost the company and settle for a fair price and not a measly sum of 1k EUR.
It is a huge red flag to keep it under the radar if they think the impact is going to be high. I'm sure it is high and that's the reason they want to keep it undisclosed while they silently patch it.
One question: Was the discovery part of a bug bounty program? Or you stumbled upon it without any actual request? I'm trying to see the legal angle that might get down played there if you do not have the authorization to look at it.
Being ethical is the only advantage I see if that is the case. Else, you should negotiate and demand a fair price and go for a public disclosure which will cause more harm than good for them.
Everything has a price. Nothing in this world is free. Contact some good lawyer.
Don't ever sign an NDA without vetting it out with a good lawyer. Fine prints matter a lot.
As some of the fellow HNs mentioned, they will probably be looking at a huge impact and the reason for the NDA and a low sum as a token appreciation. They think they can buy their way being a corporate, any my advice would be to talk to some lawyers or contact a non-profit to help sort things out.
Probably you could donate a % to them if you get a good amount.
Thanks for the thoughtful reply — really appreciate it.
I actually stumbled upon the vulnerability without any prior request. They don’t have an active bug bounty program, and the Head of IT Security I’m in touch with mentioned they don’t have dedicated funds for security researchers — which is hard to believe for a company with a £200M+ market cap.
I’ll definitely dig a bit deeper into the legal side.
Based on all the suggestions here, I’m leaning toward quoting them a fair amount considering the impact. If they don’t agree, I’ll likely reject the NDA and do a public write-up after a reasonable disclosure window.
One thing I forgot to mention earlier as of today — the vulnerability is fixed (I reported it around 3 weeks ago), not sure if that changes anything leverage wise.
Irrespective of any political views, or whatsoever be it as a human, a brilliant creator has gone from the face of the Earth!
I have always enjoyed Dilbert! Thanks for that!
Fuck cancer...
Fuck any disease that takes away human lives...