3 ms·

Someone always makes a comment like this. Honestly, the black market value (if any) has nothing to do with the whitehat bounty amount. Why should it? The person

Someone always makes a comment like this. Honestly, the black market value (if any) has nothing to do with the whitehat bounty amount. Why should it? The person who's going to do legitimate whitehat work isn't the same person who's going to sell on the black market. I think of it like drugs. $50k street value of cocaine is not going to do me a lot of good because 1) I'd have no idea where to sell it, 2) if I did know where, I wouldn't have the relationships built and would probably get ripped off/killed/what-have-you, and 3) selling drugs isn't something I'd like to do. So, if there were an option of turning in the drugs to the police for $500, I would take that instead.

mod 10y ago
Your logic is sound. I agree with the GP post about the increased value, though not for his same reasoning. Fixing this bug before an exploit is worth a LOT to the company. I think they have a moral obligation to pay more than 1k to fix it. I also think it makes sense to award good-sized bounties, as at this point I would have no interest in their bounty program, were I hunting bounties.
arcticfox 10y ago
But if the police want to incentivize you to find cocaine, how hard are you going to look for only $500? In the sense that "Oh yeah, I just casually stumbled on an enormous exploit of security software" the bounty is a good deal. In the sense that "Should I look for holes in this thing? Is it worth my time?" it's absolutely not unless the person is interested in it academically or for reputation.
- Domenic_S 10y ago
  I see it more like gun buybacks -- "we're not going to ask too many questions, you already have this dangerous thing, give it to us and here's some cash." In other words, I don't believe bug bounties incentivize people who would otherwise not already be looking, but it gives them a safe outlet and official validation that they can put on their resume/website/whatever.
skizm 10y ago
I think the point is 1) it encourages more people to go the black hat way and 2) $1000 just isn't worth all the time people spend not finding bugs before finding one. So no one is encouraged to look in the first place except maybe the few who find it fun to do in their free time. Side-note: isn't there a grey market that buys exploits (for sums of ~$100k depending on the exploit) and sells them to government agencies or larger corporations? I think I remember one company charged $500k / year to companies and government agencies who wanted access to their "exploit database". Seems like this is the best route to go with these kinds of exploits since it is completely legal.
- edanm 10y ago
  "I think the point is 1) it encourages more people to go the black hat way". How many times have people had to pay you not to commit felonies that are a) immoral, and b) could land you in jail? I think most people don't need monetary encouragement not to turn black hat.
astrodust 10y ago
Finding $50K worth of drugs is one thing, converting that to cash would involve a lot of effort on your part. This is more akin to finding the accounting records of a drug kingpin that could be used as evidence to bring them down. This could have destroyed Lastpass.

mod 10y ago

Your logic is sound. I agree with the GP post about the increased value, though not for his same reasoning. Fixing this bug before an exploit is worth a LOT to the company. I think they have a moral obligation to pay more than 1k to fix it. I also think it makes sense to award good-sized bounties, as at this point I would have no interest in their bounty program, were I hunting bounties.

arcticfox 10y ago

But if the police want to incentivize you to find cocaine, how hard are you going to look for only $500? In the sense that "Oh yeah, I just casually stumbled on an enormous exploit of security software" the bounty is a good deal. In the sense that "Should I look for holes in this thing? Is it worth my time?" it's absolutely not unless the person is interested in it academically or for reputation.

Domenic_S 10y ago
I see it more like gun buybacks -- "we're not going to ask too many questions, you already have this dangerous thing, give it to us and here's some cash." In other words, I don't believe bug bounties incentivize people who would otherwise not already be looking, but it gives them a safe outlet and official validation that they can put on their resume/website/whatever.

skizm 10y ago

I think the point is 1) it encourages more people to go the black hat way and 2) $1000 just isn't worth all the time people spend not finding bugs before finding one. So no one is encouraged to look in the first place except maybe the few who find it fun to do in their free time. Side-note: isn't there a grey market that buys exploits (for sums of ~$100k depending on the exploit) and sells them to government agencies or larger corporations? I think I remember one company charged $500k / year to companies and government agencies who wanted access to their "exploit database". Seems like this is the best route to go with these kinds of exploits since it is completely legal.

edanm 10y ago
"I think the point is 1) it encourages more people to go the black hat way". How many times have people had to pay you not to commit felonies that are a) immoral, and b) could land you in jail? I think most people don't need monetary encouragement not to turn black hat.

astrodust 10y ago

Finding $50K worth of drugs is one thing, converting that to cash would involve a lot of effort on your part. This is more akin to finding the accounting records of a drug kingpin that could be used as evidence to bring them down. This could have destroyed Lastpass.