What to do when a company refuses to fix a vulnerability I disclosed to them? 14 years ago
I don't believe it is extortion since all he is asking them to do is fix their own vulnerability. I believe extortion requires the demand of money or services in exchange for action/inaction.