709
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 27 May 2026
709 points (99.3% liked)
Technology
84965 readers
3825 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
I'm no expert. Is this an issue where MS is refusing to pay bounties to the researcher for finding the bugs, and MS follows up by deleting the researcher's git hub? Am I missing anything? If I understand the basics, this is how you turn a white hat into a black hat. Good job microslop.
So the researcher has posted on their blog over the past few months some rants about Microsoft "destroying their life" and vowing to continue to post zero days in retaliation, and has been posting proof of concept code for these zero days to their GitHub.
From their rants (there's a couple of fresh ones including indication that tomorrow will be "one of the hardest days of their life" and that they'll post a big zero day on July 14th) it sounds like Microsoft deleted their account, revoked their access to the responsible disclosure portal and they've had some back and forth discussions in private that they're now making more public
Normally what happens is researchers report vulnerabilities via Microsoft's purpose-built bug bounty portal, and Microsoft can patch these vulnerabilities before they can be actively exploited, and researchers can pocket enough income to make a living entirely off of bug bounties. Obviously this all broke down in the case of this particular researcher so here we are
His blog posts share his side of the story, but Microsoft has not made any comments about what happened.
From March 26:
Then on April 15:
There was a comment on the first post that I feel like is pretty on point, though a bit arm chair psychologist:
I don’t think we know enough information to say what the root cause is, but this is definitely not the way to go about anything on the M$ side.