<![CDATA[Microsoft, who banned Nightmare-Eclipse from their GitHub platform, conveys their displeasure with said individual]]>Microsoft, who banned Nightmare-Eclipse from their GitHub platform, conveys their displeasure with said individual

Also manages to sprinkle in a few references to not using CVD as being not "responsible". (Microsoft was a big proponent of the term "responsible disclosure", which has gone by the wayside because it tends to favor vendor-centric perspective in a subjective and moralizing way.)

]]>https://board.circlewithadot.net/topic/cb477817-ad91-4507-a7e3-3cf2f58e86ce/microsoft-who-banned-nightmare-eclipse-from-their-github-platform-conveys-their-displeasure-with-said-individualRSS for NodeFri, 05 Jun 2026 17:39:11 GMTWed, 27 May 2026 23:09:36 GMT60<![CDATA[Reply to Microsoft, who banned Nightmare-Eclipse from their GitHub platform, conveys their displeasure with said individual on Thu, 28 May 2026 14:02:14 GMT]]>@wdormann

Uncoordinated disclosures that put proof-of-concept code for unpatched vulnerabilities into the hands of bad actors are never justifiable...

Assertion not supported by currently available data. There are plenty of historical examples of vendors which have refused to act on vulnerabilities which impact customers until their arms are twisted via public disclosure.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/TomSellers/statuses/116652568360789088https://board.circlewithadot.net/post/https://infosec.exchange/users/TomSellers/statuses/116652568360789088Thu, 28 May 2026 14:02:14 GMT<![CDATA[Reply to Microsoft, who banned Nightmare-Eclipse from their GitHub platform, conveys their displeasure with said individual on Thu, 28 May 2026 12:06:59 GMT]]>@chthonic

Our Digital Crimes Unit will continue bringing cases against these actors and those that enable their criminal activity – coordinating as needed with law enforcement around the world.

This is not an olive branch. It's a threat.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116652115208490408https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116652115208490408Thu, 28 May 2026 12:06:59 GMT<![CDATA[Reply to Microsoft, who banned Nightmare-Eclipse from their GitHub platform, conveys their displeasure with said individual on Thu, 28 May 2026 10:31:10 GMT]]>@snowride509 @chthonic @wdormann Guidelines mudlines. It's not about that.

Researchers don't have to participate in responsible disclosure. They're not contractually obligated, unless they participate in bug bounties. They can just release their findings whenever they want to.

The only thing stopping most researchers from doing it is a social contract whereby the vendor takes them seriously, fixes the bug in a timely manner, and gives them credit. This has been the model the security industry coalesced around for a while.

Microsoft blatantly broke that social contract, and now they suffer the consequences, and cry crocodile tears about it. You asked for it, Microsoft. FAFO, as the kids these days say.

Link Preview ImageLink Preview Image
]]>https://board.circlewithadot.net/post/https://tech.lgbt/users/pq1r/statuses/116651738404099182https://board.circlewithadot.net/post/https://tech.lgbt/users/pq1r/statuses/116651738404099182Thu, 28 May 2026 10:31:10 GMT<![CDATA[Reply to Microsoft, who banned Nightmare-Eclipse from their GitHub platform, conveys their displeasure with said individual on Thu, 28 May 2026 05:31:05 GMT]]>@tiraniddo @wdormann more emphasis on "responsibility" here

Link Preview Image
From Capability to Responsibility: Securing our global digital ecosystem with next‑generation AI

Cybersecurity is at a turning point as AI accelerates vulnerability discovery, requiring safeguards and faster response.

favicon

Microsoft On the Issues (blogs.microsoft.com)

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/aristot73/statuses/116650558446737781https://board.circlewithadot.net/post/https://infosec.exchange/users/aristot73/statuses/116650558446737781Thu, 28 May 2026 05:31:05 GMT<![CDATA[Reply to Microsoft, who banned Nightmare-Eclipse from their GitHub platform, conveys their displeasure with said individual on Thu, 28 May 2026 05:00:12 GMT]]>@wdormann "gone by the wayside" good, they literally made it up to bully researchers.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/0x00string/statuses/116650437039385754https://board.circlewithadot.net/post/https://infosec.exchange/users/0x00string/statuses/116650437039385754Thu, 28 May 2026 05:00:12 GMT<![CDATA[Reply to Microsoft, who banned Nightmare-Eclipse from their GitHub platform, conveys their displeasure with said individual on Thu, 28 May 2026 04:55:09 GMT]]>@wdormann and zero acknowledgement that MiniPlasma shouldn't even exist in any form. Total lack of self awareness.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/tiraniddo/statuses/116650417188421924https://board.circlewithadot.net/post/https://infosec.exchange/users/tiraniddo/statuses/116650417188421924Thu, 28 May 2026 04:55:09 GMT<![CDATA[Reply to Microsoft, who banned Nightmare-Eclipse from their GitHub platform, conveys their displeasure with said individual on Thu, 28 May 2026 01:03:50 GMT]]>@wdormann we should rename “responsible disclosure” to “Samaritan snare”

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/joshbressers/statuses/116649507615893035https://board.circlewithadot.net/post/https://infosec.exchange/users/joshbressers/statuses/116649507615893035Thu, 28 May 2026 01:03:50 GMT<![CDATA[Reply to Microsoft, who banned Nightmare-Eclipse from their GitHub platform, conveys their displeasure with said individual on Thu, 28 May 2026 00:59:35 GMT]]>@chthonic @wdormann This is absolutely not “normal” but it does happen enough for the pattern to show itself…namely the vendor here is making ticky-tack calls to not provide a bounty. Yes, MSRC has public guidelines, but they are often too rigid, IMHO. Whatever bounties were in play, they are cheaper than all the ish that has happened, namely the brand impact to MSFT.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/snowride509/statuses/116649490852216641https://board.circlewithadot.net/post/https://infosec.exchange/users/snowride509/statuses/116649490852216641Thu, 28 May 2026 00:59:35 GMT<![CDATA[Reply to Microsoft, who banned Nightmare-Eclipse from their GitHub platform, conveys their displeasure with said individual on Thu, 28 May 2026 00:03:30 GMT]]>@wdormann It seems like Microsoft is also extending an olive-branch towards the end where they state they will work with any disclosure reported by whoever, regardless of reputation. From what I gather here it looks like they're laying the DCU threat while trying to keep a door open for negotiation with Nightmare-Eclipse. As a newbie, this is not how it usually goes correct? And there's no way for the public as third parties to verify either sides claims (did Nightmare-Eclipse report and then an agreement was not verified or did they simply not report at all?)

]]>https://board.circlewithadot.net/post/https://infosec.exchange/ap/users/116648919470972362/statuses/116649270315923854https://board.circlewithadot.net/post/https://infosec.exchange/ap/users/116648919470972362/statuses/116649270315923854Thu, 28 May 2026 00:03:30 GMT