Hacker News Reader

Hash + reputation = documented finding.

Note that the hash isn't my idea. People have been doing it for years.

Subtracting "reputation" as a requirement in that equation has to have at least a small positive value, doesn't it? I don't know how many independent researchers there are who have a chicken-and-egg problem with reputation because they don't know how to disclose both visibly and responsibly. But if there are any, Zed's method seems beneficial.

If I could have understood with that much additional information, I wouldn't have asked in the first place.

I think point of hashing is to prove that researcher has indeed found the vulnerability first and reported it to the vendor. It is proof for "this summary was written by me 2 months ago".

Hash must be posted to some archived/public place (tweet, mailing list, etc) that can be referenced at later date when actual summary is released.

Reply on news.ycombinator.com