# Let's Go

LG webOS TV coordinated vulnerability disclosure.

I have not described any vulnerability here yet. Two files record what I sent to
LG Electronics PSRC and when, so that once the findings go public you can check
they match what I committed to today.

`CLAIMS.txt` holds one commitment per finding, covering its identifier, its
weakness class and its title. Each hash also covers a 32-byte random nonce, so you
cannot attack it by guessing headlines. At disclosure I publish the nonces and the
headlines and you recompute every line.

I revise findings while LG works through them. Committing to each one on its own
line means a reworded report replaces that line and leaves the rest standing.

`MANIFEST-DIGEST` carries the SHA-256 of a manifest listing every document in the
package. That pins the exact files I sent, so it moves whenever I revise anything.
`CLAIMS.txt` is the layer that survives revision.

`CLAIMS.txt.ots` and `MANIFEST.txt.ots` are OpenTimestamps receipts, anchored in
the Bitcoin blockchain. Checking the dates costs you no trust in this repo, this
domain, or me.

I am holding the manifest back until disclosure. Its file list names each report,
which would give away the findings it exists to record.

When the window closes I publish the package and the manifest here, unchanged.
Then you can run:

```sh
ots verify CLAIMS.txt.ots                            # confirms the date
printf '%s\n%s' "$NONCE" "$RECORD" | shasum -a 256   # matches a line in CLAIMS.txt

shasum -a 256 MANIFEST.txt                           # matches MANIFEST-DIGEST
shasum -a 256 -c <(tail -n +7 MANIFEST.txt | awk '{print $1"  "$2}')
```

Michael McCord, michael@mccord.ai