8 ms·

>Cloudflare pointed out their bug bounty program, but I noticed it has a top-tier reward of a t-shirt. Considering the amount and sensitivity of the data they

>Cloudflare pointed out their bug bounty program, but I noticed it has a top-tier reward of a t-shirt. Considering the amount and sensitivity of the data they handle, I'm not sure a t-shirt is an appropriate top-tier reward.

minxomat 10y ago
Not only that, but the "reward" in the program is laughable and frankly insulting to any serious researcher considering the scope of CF. Bug bounty platforms are already becoming the fiverr of ITSEC (that's not a good thing), CF just made an extra effort do diminish the value for researchers. Management: "Why do we offer $5k for a small bug again? Look at CF, they don't offer any money!"
- eli 10y ago
  If serious researchers are looking to get paid, I think bug bounties are the wrong approach entirely
  - manigandham 10y ago
    Why? Many can help find problems without having to be full-time, that's the point of crowd-sourcing with payouts.
    - eli 10y ago
      Because you'll make much more working for people who specifically hire you instead of doing a bunch of risky work on spec.
      - cperciva 10y ago
        The point of bug bounties isn't to attract the interest of people who are working to find bugs. It's to make sure that if someone is finding bugs for fun or stumbles over bugs by accident, it's worth their time to report the bugs.
        blacksmythe 10y ago
        >> top-tier reward of a t-shirt. A t-shirt still seems entirely too small; closer to insulting than motivating.
        cperciva 10y ago
        Sure. I was talking about the general purpose of bug bounties, not the specific value.
      - x0 10y ago
        An actual pentest would include (I'm assuming) all sorts of NDA's and legal contracts and stuff, all fine if you work in the industry but if you're a bored hobbyist like me, bug bounties are a fun way to try and make a few dollars.
  - Mandatum 10y ago
    A lot of pentesters make good money off bounty hunting. Some months they make more money off hunting than they do their day job.
  - mabbo 10y ago
    It's about payoff * probability. Let's say I (an idiot, but knowledgeable enough) stumble upon a serious vulnerability in Google. Option 1: I could try to sell that on a darknet market for a decent amount of money. State actors, hacker groups, lots of people want to pay for such things to exploit. But, I might not get paid very much, I might get screwed over, I might go to jail, who the heck knows, I'm playing with a bit of fire here. Could make a good pay day though. Option 2: Google offers a bug bounty that is known to pay well. It probably offers guidance on how much my exploit is worth. They'll almost certainly pay. And hey, no one gets exploited, which most people feel is a good thing. Value = payout * probability. If bug bounties pay well, option 2 has a higher value most of the time. But if a company offers t-shirts, or is known for screwing over the discoverer, the perceived value falls quickly. That's why companies who take security seriously pay good bounties, loudly and publicly.
    - flukus 10y ago
      > I might go to jail Is selling exploits illegal? If so is selling them to google also illegal?
      - jstanley 10y ago
        Telling Google about exploits in Google services in exchange for money is not illegal. Telling them about exploits in other services in exchange for money might be, depending on context. Your parent was talking about the former case.
      - SteveNuts 10y ago
        You're not so much selling them to google, you're disclosing them. It's more of a contractual agreement between you and Google, or whatever company you're reporting the vulnerability to. As long as you follow the rules for their bug bounty, you'll be fine.
      - mabbo 10y ago
        > Is selling exploits illegal? Maybe. If the FBI decides to build a case against you for it, I'm sure they could find a law to use. > is selling them to google also illegal? I'm disclosing, and Google is granting me a reward. There's... Some difference I'm sure.
- p0rkbelly 10y ago
  I don't disagree. But, Taviso is probably contractually prohibited from accepting money from CF as a Google employee. Many large companies have 'outside activity' clauses and Google seems to be paying him already for that. However, it will affect others whom are fully freelance.
- ifdefdebug 10y ago
  > "Why do we offer $5k for a small bug again? Look at CF, they don't offer any money!" Answer: "Because if they had set up a bounty of $50k for security issues, they'd had thousands of researchers/students/white hats etc. watching the output of their servers."
  - annnnd 10y ago
    "...and could maybe avoid or lessen the impact of this fiasco."
eli 10y ago
I never really got this argument. Is it not much better than the majority of companies that have no bug bounty and where the reporter needs to worry they will be met with legal threats instead of a t-shirt?
mdekkers 10y ago
I got a t-shirt from cloudflare, and all i did was tell them "please send me a t-shirt" - they shipped it halfway across the world as well, for free! (it didn't fit...)
raverbashing 10y ago
Good to know the security of their users is worth a t-shirt

minxomat 10y ago

Not only that, but the "reward" in the program is laughable and frankly insulting to any serious researcher considering the scope of CF. Bug bounty platforms are already becoming the fiverr of ITSEC (that's not a good thing), CF just made an extra effort do diminish the value for researchers. Management: "Why do we offer $5k for a small bug again? Look at CF, they don't offer any money!"

eli 10y ago
If serious researchers are looking to get paid, I think bug bounties are the wrong approach entirely
- manigandham 10y ago
  Why? Many can help find problems without having to be full-time, that's the point of crowd-sourcing with payouts.
  - eli 10y ago
    Because you'll make much more working for people who specifically hire you instead of doing a bunch of risky work on spec.
    - cperciva 10y ago
      The point of bug bounties isn't to attract the interest of people who are working to find bugs. It's to make sure that if someone is finding bugs for fun or stumbles over bugs by accident, it's worth their time to report the bugs.
      - blacksmythe 10y ago
        >> top-tier reward of a t-shirt. A t-shirt still seems entirely too small; closer to insulting than motivating.
        cperciva 10y ago
        Sure. I was talking about the general purpose of bug bounties, not the specific value.
    - x0 10y ago
      An actual pentest would include (I'm assuming) all sorts of NDA's and legal contracts and stuff, all fine if you work in the industry but if you're a bored hobbyist like me, bug bounties are a fun way to try and make a few dollars.
- Mandatum 10y ago
  A lot of pentesters make good money off bounty hunting. Some months they make more money off hunting than they do their day job.
- mabbo 10y ago
  It's about payoff * probability. Let's say I (an idiot, but knowledgeable enough) stumble upon a serious vulnerability in Google. Option 1: I could try to sell that on a darknet market for a decent amount of money. State actors, hacker groups, lots of people want to pay for such things to exploit. But, I might not get paid very much, I might get screwed over, I might go to jail, who the heck knows, I'm playing with a bit of fire here. Could make a good pay day though. Option 2: Google offers a bug bounty that is known to pay well. It probably offers guidance on how much my exploit is worth. They'll almost certainly pay. And hey, no one gets exploited, which most people feel is a good thing. Value = payout * probability. If bug bounties pay well, option 2 has a higher value most of the time. But if a company offers t-shirts, or is known for screwing over the discoverer, the perceived value falls quickly. That's why companies who take security seriously pay good bounties, loudly and publicly.
  - flukus 10y ago
    > I might go to jail Is selling exploits illegal? If so is selling them to google also illegal?
    - jstanley 10y ago
      Telling Google about exploits in Google services in exchange for money is not illegal. Telling them about exploits in other services in exchange for money might be, depending on context. Your parent was talking about the former case.
    - SteveNuts 10y ago
      You're not so much selling them to google, you're disclosing them. It's more of a contractual agreement between you and Google, or whatever company you're reporting the vulnerability to. As long as you follow the rules for their bug bounty, you'll be fine.
    - mabbo 10y ago
      > Is selling exploits illegal? Maybe. If the FBI decides to build a case against you for it, I'm sure they could find a law to use. > is selling them to google also illegal? I'm disclosing, and Google is granting me a reward. There's... Some difference I'm sure.
p0rkbelly 10y ago
I don't disagree. But, Taviso is probably contractually prohibited from accepting money from CF as a Google employee. Many large companies have 'outside activity' clauses and Google seems to be paying him already for that. However, it will affect others whom are fully freelance.
ifdefdebug 10y ago
> "Why do we offer $5k for a small bug again? Look at CF, they don't offer any money!" Answer: "Because if they had set up a bounty of $50k for security issues, they'd had thousands of researchers/students/white hats etc. watching the output of their servers."
- annnnd 10y ago
  "...and could maybe avoid or lessen the impact of this fiasco."

eli 10y ago

I never really got this argument. Is it not much better than the majority of companies that have no bug bounty and where the reporter needs to worry they will be met with legal threats instead of a t-shirt?

mdekkers 10y ago

I got a t-shirt from cloudflare, and all i did was tell them "please send me a t-shirt" - they shipped it halfway across the world as well, for free! (it didn't fit...)

raverbashing 10y ago

Good to know the security of their users is worth a t-shirt