OberonXanatos

It is mainly helpful for me with writers block.

Interesting, I always worry about how companies may be able to twist the law if they see someone reporting a data leak and they loose money because of bad publicity.

http://www.dmlp.org/blog/2013/government-responds-dmlp-amicu... http://www.wired.com/2013/03/att-hacker-gets-3-years/

Much appreciated I had not thought of this route and you saved me a google search.

I have read through cert.org and it is an excellent resource for responsible disclosure guidance and have been looking for a third party to disclose on my behalf in order to avoid legal trouble should the take the news in a twisted way.

I actually submitted a report to their site back in January and received a reply that they "Typically avoid publishing or handling vulnerabilities that affect live websites"

Full disclosure mailing list seems intriguing, I have not actually thought of this before. Are companies generally receptive to this kind of disclosure. If someone maliciously dumps all their customer records and posts them on pastebin is it likely that I may get in legal trouble?

I have been sending emails asking for a place to disclose the issue since January.