18 ms·

It sounds like you need HackerOne Disclosure Assistance https://support.hackerone.com/hc/en-us/articles/115001936043-What-is-Disclosure-Assistance-and-how-does-

by sytse 10y ago

It sounds like you need HackerOne Disclosure Assistance https://support.hackerone.com/hc/en-us/articles/115001936043-What-is-Disclosure-Assistance-and-how-does-it-work- https://support.hackerone.com/hc/en-us/articles/115001936043... This was introduced 3 days ago https://twitter.com/martenmickos/status/854321634404061185 https://twitter.com/martenmickos/status/854321634404061185 HackerOne will work with friendly hackers on a best effort basis to verify the legitimacy of a vulnerability, reach out to and verify the identity of an individual at the affected organization, then share the vulnerability with the organization so it can be resolved. Seems like it address most of the problems of educating the organization so they don't threaten you.

summarite 10y ago
Just that they have a name that will immediately be without any trust at any non -tech company. Basically mentioning "hacking" will make any non-technical CEO shiver and call the lawyers.
- anigbrowl 10y ago
  OK, let the lawyers handle it. You don't make progress by catering to other people's ignorance and insecurities.
  - mcmarables 10y ago
    You are right, that isn't how you make progress: it's how you make money.
- sytse 10y ago
  The name is not ideal. I've heard a story of it also not being great for employees when talking to custom officers :/ But any person looking at their homepage would be a lot less concerned. Impressive logo's and a clear story for an enterprise audience.
- tptacek 10y ago
  It is unlikely that there is a company in the US that has a security team that hasn't heard of H1. They're kind of a big deal. Since they're the ones handling the first contact in these situations, you can safely let their name be their problem; they know how to explain themselves. The more realistic concern here is that for these kinds of findings --- CSRFs in random web applications --- there simply isn't going to be a contact at the target company, and H1 isn't going to find one for you. That's why they point out they can't promise a contact.
  - yeukhon 10y ago
    >It is unlikely that there is a company in the US that has a security team that hasn't heard of H1. You'd be surprised. HackerOne is relatively new, just several years old. Does everyone know OWASP, almost certainly yes. Does everyone know the BSide community? No. Anyway, H1 can act as a shield, in this case. On the other hand, companies like WhiteHat or Rapid7 are probably more well-known since they will probably spam your security team on a regular basis trying to sell their products.
- dankohn1 10y ago
  Disagree. Any big company can be sufficiently ignorant, but Hackerone and Marten Mickos both have a brand name associated with them, partially due to their funding: https://www.crunchbase.com/organization/hackerone#/entity https://www.crunchbase.com/organization/hackerone#/entity I think the disclosure assistance is a pretty clever idea for generating new sales leads, since by definition they will be talking to companies with an actual zero day situation.
Animats 10y ago
That's some startup that's trying to become an intermediary for bug bounty programs. They're in a WeWork shared space at WeWork Transbay on Mission in SF. Unless they're hosting a bug bounty program for the vendor involved, they don't add any value.
- tptacek 10y ago
  They're the largest and most important bug bounty service, and have been for years. WeWork leases offices; they have a shared workspace area in all the buildings, but most of their buildings are private offices. Apart from the fact that there's a good chance the company you're trying to report to already has an H1 program running, what they're promising to do here is to spend some effort trying to track down security contacts for you. They profit from this, of course: if you give them a good bug, and they facilitate its reporting, the target company is very likely to sign up for H1. But it costs you nothing and might solve a problem for you. (I'm ambivalent about H1 --- we run a couple H1 bounty programs that existed prior to us taking over security at our clients --- but I don't think it's a good idea to be dismissive of them.)
fulldecent 10y ago
I would be more supportive if HackerOne just gave me a form so I can do this myself. I do not need HackerOne to take credit for my work and and do not need them to represent me. I'm a big boy and can follow my own ethics and take my own consequences. If other people feel the same way, I'll fork and make a repo. EFF is a great starting point but it is not nearly usable as a HOWTO. I'm putting my balls on the line by publishing this blog post. Actually I started this blog 10 years ago just to make this page, here is the original page: https://privacylog.blogspot.com/2008/10/pre-announcement.html https://privacylog.blogspot.com/2008/10/pre-announcement.htm...

by sytse 10y ago

summarite 10y ago

Just that they have a name that will immediately be without any trust at any non -tech company. Basically mentioning "hacking" will make any non-technical CEO shiver and call the lawyers.

anigbrowl 10y ago
OK, let the lawyers handle it. You don't make progress by catering to other people's ignorance and insecurities.
- mcmarables 10y ago
  You are right, that isn't how you make progress: it's how you make money.
sytse 10y ago
The name is not ideal. I've heard a story of it also not being great for employees when talking to custom officers :/ But any person looking at their homepage would be a lot less concerned. Impressive logo's and a clear story for an enterprise audience.
tptacek 10y ago
It is unlikely that there is a company in the US that has a security team that hasn't heard of H1. They're kind of a big deal. Since they're the ones handling the first contact in these situations, you can safely let their name be their problem; they know how to explain themselves. The more realistic concern here is that for these kinds of findings --- CSRFs in random web applications --- there simply isn't going to be a contact at the target company, and H1 isn't going to find one for you. That's why they point out they can't promise a contact.
- yeukhon 10y ago
  >It is unlikely that there is a company in the US that has a security team that hasn't heard of H1. You'd be surprised. HackerOne is relatively new, just several years old. Does everyone know OWASP, almost certainly yes. Does everyone know the BSide community? No. Anyway, H1 can act as a shield, in this case. On the other hand, companies like WhiteHat or Rapid7 are probably more well-known since they will probably spam your security team on a regular basis trying to sell their products.
dankohn1 10y ago
Disagree. Any big company can be sufficiently ignorant, but Hackerone and Marten Mickos both have a brand name associated with them, partially due to their funding: https://www.crunchbase.com/organization/hackerone#/entity https://www.crunchbase.com/organization/hackerone#/entity I think the disclosure assistance is a pretty clever idea for generating new sales leads, since by definition they will be talking to companies with an actual zero day situation.

Animats 10y ago

That's some startup that's trying to become an intermediary for bug bounty programs. They're in a WeWork shared space at WeWork Transbay on Mission in SF. Unless they're hosting a bug bounty program for the vendor involved, they don't add any value.

tptacek 10y ago
They're the largest and most important bug bounty service, and have been for years. WeWork leases offices; they have a shared workspace area in all the buildings, but most of their buildings are private offices. Apart from the fact that there's a good chance the company you're trying to report to already has an H1 program running, what they're promising to do here is to spend some effort trying to track down security contacts for you. They profit from this, of course: if you give them a good bug, and they facilitate its reporting, the target company is very likely to sign up for H1. But it costs you nothing and might solve a problem for you. (I'm ambivalent about H1 --- we run a couple H1 bounty programs that existed prior to us taking over security at our clients --- but I don't think it's a good idea to be dismissive of them.)

fulldecent 10y ago

I would be more supportive if HackerOne just gave me a form so I can do this myself. I do not need HackerOne to take credit for my work and and do not need them to represent me. I'm a big boy and can follow my own ethics and take my own consequences. If other people feel the same way, I'll fork and make a repo. EFF is a great starting point but it is not nearly usable as a HOWTO. I'm putting my balls on the line by publishing this blog post. Actually I started this blog 10 years ago just to make this page, here is the original page: https://privacylog.blogspot.com/2008/10/pre-announcement.html https://privacylog.blogspot.com/2008/10/pre-announcement.htm...