Researcher Trolls Microsoft Over Bug Disclosure Annoyance

Arthur T Knackerbracket has processed the following story:

A vulnerability analyst and prominent member of the infosec industry has blasted Microsoft for refusing to look at a bug report unless he submitted a video alongside a written explanation.

Senior principal vulnerability analyst Will Dormann said last week he contacted Microsoft Security Response Center (MSRC) with a clear description of the bug and supporting screenshots, only to be told that his report wouldn't be looked at without a video.

MSRC told Dormann: "As requested, please provide clear video POC (proof of concept) on how the said vulnerability is being exploited? We are unable to make any progress without that. It will be highly appreciated."

Frustrated with Microsoft's demand, which Dormann said would only show him typing commands that were already depicted in the screenshots, and hitting Enter in CMD, the analyst created a video laden with malicious compliance.

The video is 15 minutes long and at the four-second mark flashes a screenshot from Zoolander, in which the protagonist unveils the "Center for Kids Who Can't Read Good."

It also features a punchy techno backing track while wasting the reviewer's time with approximately 14 minutes of inactivity.

Dormann said via Mastodon: "I get that people doing grunt work have mostly fixed workflows that they go through with common next steps.

"But to request a video that now captures (beyond my already-submitted screenshots) the act of me typing, and the Windows response being painted on the screen adds what of value now?"

To top it all off, when trying to submit the video via Microsoft's portal, the upload failed due to a 403 error.

Read more of this story at SoylentNews.