6 ms·
Give the person a small reward for pointing out the vulnerability and offer another small reward for suggesting how to fix it.
by disease 10y ago
Give the person a small reward for pointing out the vulnerability and offer another small reward for suggesting how to fix it.
- edelans 10y agowhy small ? the reward should be in accordance with the criticity IMHO.
- terminado 10y agoIs "criticity" a word with actual cromulence? I feel like I've been embiggened by learning it today.
- brianwawok 10y agoSo a startup with 100k total funding got messaged a major company crushing bug. What should they offer for such a big find, 50k? Half their runway? It's not that rewards should be small for big finds, but if you are legit poor, you have limits on what you can do.
- nstr10 10y agoRewards should always be in accordance with made-up words IMHO.
- junke 10y agoMaybe hire that person?
- dimino 10y agoHire someone because they exploited a single vulnerability?
- dozzie 10y agoI've heard of much worse hiring practices than to base on a single display of competence.
- cgriswald 10y agoIn the late nineties/early aughts, I worked for a company that hired a pair of guys after those guys showed up holding basically all the data from one of the company's services. The company started using these guys' custom software instead. The server running this software was in our main server room although it was technically not our department. So one day, when a fairly serious bug was found, I had to chaperone the non-technical person into the service room. She was on the phone with these guys. For political reasons within the company, all I could do was watch. They instructed her, over the phone, symbol-and-letter by symbol-and-letter to add to live production code. What they added? A giant "if false" block around the buggy code.
- dimino 10y agoTrue. Then again, I've heard of many better hiring practices as well. Even odds it's a current employee, anyway.
- rimantas 10y agoGod forbid. No hire if they cannot reverse binary tree on the whiteboard using angular react e6.
- deleted 10y ago[deleted]
- dozzie 10y agoThe guy that couldn't "reverse a binary tree" came from a team that turned out to be incompetent (in operations field; they didn't see anything wrong with distributing all the packages with software using HTTP without SSL/TLS nor any cryptographic signature).
- Chlorus 10y agoAre we talking about Homebrew guy? Was this a flaw in Homebrew or something else he worked on?
- robocat 10y agoTo be fair, some major Linux distros also distribute using http e.g. go to https://www.debian.org/ https://www.debian.org/ and check the Download link at the top of the page: it is http.
- clort 10y agoMaybe offering a reward is a good way to reduce the anonymity of the person, since rewards can be tracked. Speaking only for myself.. If I were to go the trouble to anonymously tip somebody off about a security vulnerability, it would be because I cared that they were secure and that I did not wish to be identified. I would neither expect nor accept a reward.
- brokenmachine 10y agoYes but a white hat like you would probably give at least some hints on how to fix it or what vulnerability you have discovered, not just a screenshot showing that you have/had access. I think just the fact that they didn't do this points to malevolence. I would expect the ransom demands to follow shortly.