These are the standards every piece on Cyber-Threat.net is written to, whoever’s name is on it.
Accuracy and sources
- We work from primary sources wherever they exist: vendor advisories, CVE records, government guidance, court documents and the legislation itself. We link to them, so you can check our reading against theirs.
- Where we rely on someone else’s reporting, we say whose it is.
- We separate what is confirmed from what is claimed. “Exploited in the wild” means somebody credible has said so, and we tell you who.
- Version numbers, dates and figures are checked before publication. Prices carry the date we checked them.
- A detection rule is published as tested only after it has been run against sample logs, and each rule states what it was tested against. Anything untested is labelled as a draft. Either way, test it in your own environment before you rely on it.
Independence
- No vendor, sponsor or advertiser sees a piece before publication, or has any say over what we write.
- We don’t accept payment for coverage. Anything paid for will be labelled “Ad” before you get to it.
- If we have been given a product to review, or travel to an event, we say so in the piece.
- Opinion is labelled as opinion.
Advertising and affiliate links
Paid placements in the newsletter or on the site are labelled “Ad” in the placement itself. Promotions for our own work are labelled “From Cyber-Threat.net”. If we ever use affiliate links, an article built around them will be labelled “Ad” before you reach it, and each affiliate link will be marked “(Ad)”. We don’t currently have any advertising or affiliate deals.
Pen names
Our writers publish under house pen names, one for each regular beat. These standards apply equally to all of them, and the editor is answerable for everything we publish.
Responsible disclosure
We don’t publish working exploit code for vulnerabilities that are unpatched, and we don’t publish stolen data or credentials. If a reader tells us about a vulnerability that hasn’t yet been reported to the vendor, we will encourage them to report it before we write about it.
Corrections
We get things wrong sometimes. When we do, we would rather hear about it than not.
- To report an error, email newsletter@cyber-threat.net with “Correction” in the subject line, the article and what you believe is wrong.
- Significant errors are corrected promptly. A note at the foot of the article says what changed and when.
- Small fixes, such as typos or broken links, are made without a note.
- Where security advice was wrong, such as an incorrect affected version or a fix that doesn’t work, the correction goes at the top of the article, and in the next issue of The Long Watch.
- We don’t quietly delete articles. If a piece has to be withdrawn, we say so on the page and explain why.
Updates
Security stories move. When we add material information to a published piece, we mark it as an update with the date. Articles that track a developing situation say when they were last updated.