Hacker News Reader

How does this SHA-1 hash come full circle? Everybody on the web will know that I hashed something. The vender knows that I hashed the findings I sent to them, but so what? Do I have to post the hash on my own domain, so the vender knows that the findings they received are from the same person who owns the domain where the hash was posted?

I don't see what this hash achieves.

View on HN

Hash + reputation = documented finding.

Note that the hash isn't my idea. People have been doing it for years.

Subtracting "reputation" as a requirement in that equation has to have at least a small positive value, doesn't it? I don't know how many independent researchers there are who have a chicken-and-egg problem with reputation because they don't know how to disclose both visibly and responsibly. But if there are any, Zed's method seems beneficial.

If I could have understood with that much additional information, I wouldn't have asked in the first place.

I think point of hashing is to prove that researcher has indeed found the vulnerability first and reported it to the vendor. It is proof for "this summary was written by me 2 months ago".

Hash must be posted to some archived/public place (tweet, mailing list, etc) that can be referenced at later date when actual summary is released.

Reply on news.ycombinator.com