6 ms·

Amazing that all publicly traded companies are not by law required to have bug bounties. Same goes for any major open source project too.

by nxzero 11y ago

ludamad 11y ago
At what point should a piece of software have a bug bounty? It seems forcing bug bounties would cause them to become purposefully convoluted to obtain
- nxzero 11y ago
  Just even having a page, with a small bounty, and a secure means of submitting a exploitable bug. If you want to dig deeper, I'd contact professional bug hunters and ask them how to insure that the value on the bug matches the reward.
  - ugexe 11y ago
    And if you can't afford to pay a bounty just don't write software right? Don't you think it's odd your answer to what you are replying to is "I have no idea, ask someone who knows" yet you feel compelled to weigh in on who should not be allowed to write/distribute software?
    - nxzero 11y ago
      Unclear why you believe that a major software project would not be able to find a sponsor for a bug bounty; in fact, many major projects already have bug bounty sponsors. Also, why would it be strange to suggest talking to someone other than myself?
ashitlerferad 11y ago
Open source projects rarely have a budget for development, let alone bug bounties.
cderwin 11y ago
Yes why don't we incentivize companies to keep more software closed source than already is
hntuesday 11y ago
Nobody should have to offer bounties. Researchers should not expect to get paid for their unsolicited work. We probably agree that vulnerability reports should be seen as a positive thing. What software owners should have are policies and procedures for transparently handling vulnerability disclosures. At most, I think having some flexible process should be required as part of a certification (PCI, etc). I do think that knowledge of a vulnerability and lack of action to fix it in a reasonable amount of time, which results in a breach should be treated more seriously. At the same time, encouraging reports of breaches is hard as it is and introducing more punishment would make everyone want to just keep quiet or as ambiguous as possible. I'm not sure what a good solution to this would be.
- cmdrfred 11y ago
  > Nobody should have to offer bounties. Researchers should not expect to get paid for their unsolicited work. The Chinese and Russian exploit markets don't seem to care if the work was solicited or not.
zhte415 11y ago
Publicly traded companies are required to face fines for negligence, for information leaks, fraud, or other. As are all companies. If they choose bug bounties to help with this, good for them. If they choose other measures, also good too. They simply need to show they take effort to protect information as dictated by information security laws, or internal policy, whichever is stricter.
- kevin_thibedeau 11y ago
  Maybe in Euro-land. In the US companies with data breaches are the hapless victims of those nasty hacker types. You wouldn't want to blame the victim would you? Never mind that they have a column of plaintext passwords in a web accessible server.

Amazing that all publicly traded companies are not by law required to have bug bounties. Same goes for any major open source project too.

by nxzero 11y ago

Amazing that all publicly traded companies are not by law required to have bug bounties. Same goes for any major open source project too.

ludamad 11y ago

At what point should a piece of software have a bug bounty? It seems forcing bug bounties would cause them to become purposefully convoluted to obtain

nxzero 11y ago
Just even having a page, with a small bounty, and a secure means of submitting a exploitable bug. If you want to dig deeper, I'd contact professional bug hunters and ask them how to insure that the value on the bug matches the reward.
- ugexe 11y ago
  And if you can't afford to pay a bounty just don't write software right? Don't you think it's odd your answer to what you are replying to is "I have no idea, ask someone who knows" yet you feel compelled to weigh in on who should not be allowed to write/distribute software?
  - nxzero 11y ago
    Unclear why you believe that a major software project would not be able to find a sponsor for a bug bounty; in fact, many major projects already have bug bounty sponsors. Also, why would it be strange to suggest talking to someone other than myself?

ashitlerferad 11y ago

Open source projects rarely have a budget for development, let alone bug bounties.

cderwin 11y ago

Yes why don't we incentivize companies to keep more software closed source than already is

hntuesday 11y ago

Nobody should have to offer bounties. Researchers should not expect to get paid for their unsolicited work. We probably agree that vulnerability reports should be seen as a positive thing. What software owners should have are policies and procedures for transparently handling vulnerability disclosures. At most, I think having some flexible process should be required as part of a certification (PCI, etc). I do think that knowledge of a vulnerability and lack of action to fix it in a reasonable amount of time, which results in a breach should be treated more seriously. At the same time, encouraging reports of breaches is hard as it is and introducing more punishment would make everyone want to just keep quiet or as ambiguous as possible. I'm not sure what a good solution to this would be.

cmdrfred 11y ago
> Nobody should have to offer bounties. Researchers should not expect to get paid for their unsolicited work. The Chinese and Russian exploit markets don't seem to care if the work was solicited or not.

zhte415 11y ago

Publicly traded companies are required to face fines for negligence, for information leaks, fraud, or other. As are all companies. If they choose bug bounties to help with this, good for them. If they choose other measures, also good too. They simply need to show they take effort to protect information as dictated by information security laws, or internal policy, whichever is stricter.

kevin_thibedeau 11y ago
Maybe in Euro-land. In the US companies with data breaches are the hapless victims of those nasty hacker types. You wouldn't want to blame the victim would you? Never mind that they have a column of plaintext passwords in a web accessible server.