Hacker News Reader

Material threat to be identified within 96 hours?

How would receiving an encrypted email detailing a vulnerability of your flagship product fit with the 96 hours, given that 90 days are often needed to fix said vulnerability (s) before informing the public?

In short, wouldn't that company's vulnerability make for excellent zero-days while they are trying to repair and retest the problematic product?

View on HN

my interpretation of this is that the existence/disclosure of a vulnerability is entirely distinct from a data breach event (the SEC is mainly concerned with the latter)

Ummm, ChatGPT is a vulnerability or a data breech if new stock tips can be had this way?

slow down there fellow: >Under the incoming cybersecurity disclosure requirements, first approved by the SEC in July, organizations must report cybersecurity incidents, such as data breaches, to the SEC in a specific line item on a Form 8-K report within four business days

first line. It's going to a speicif org, not russian hackers in siberia.

I agree, that better be one damn secure batphone they're using.

8-K filings are public filings. You can see them on SEC's EDGAR database

Reply on news.ycombinator.com