Hacker News Reader

Full disclosure is not "irresponsible", and plenty of researchers do it even in the absence of armchair psychoanalysis by the Internet.

View on HN

Most of them follow specific timelines for those disclosures which are communicated with the affected vendor.

And also don't follow up a disclosure with an offer to sell exploits to the highest bidder.

Is selling an exploit to a foreign government even 100% legal? (Serious question; that seems like the sort of thing that could get one in trouble.)

If you sold to a country with standing sanctions, that could be an issue. 0-day's can also be considered munitions in some interpretations of law, though I am not a lawyer nor a weapons dealer.

Reply on news.ycombinator.com