3 ms·

I'm surprised that anyone at the big Corp actually bothered to even reply to this guy reporting the bug much less actually give him a bounty!

sushid 9y ago
Google's known for their fast triage/response time. They're also fairly generous with their bounties.
nodesocket 9y ago
Where is this resentment and skepticism coming from? The facts say otherwise. Google is known to be receptive to bounties and payout.
- to3m 9y ago
  Most of their consumer-facing services are not, shall we say, famous for being high-touch... But presumably different people look after the security side of things.
- kristianp 9y ago
  This story from yesterday has raised some resentment about google's support: A startup’s Firebase bill suddenly increased from $25 to $1750 per month https://news.ycombinator.com/item?id=14356409 https://news.ycombinator.com/item?id=14356409
  - joatmon-snoo 9y ago
    Their customer/enterprise support is notoriously sketchy, at least from the outside (a la HN) looking in. That's not the same at all as their bug bounty program, which is generally one of the best out there.
carvalho 9y ago
Depending on the severity of your finding, your report could wake up a senior security engineer. When your report is out of scope, Google will not ignore your report. When there is a non-serious bug, you get acknowleged in the bug report they file internally. Finally, when they can not replicate your finding, they will communicate that with you and stay patient until they can either replicate or close your report. Edit: forgot to add that they raised the bounty with another 2k ("we updated our payouts") and they invited me to their Blackhat booth 1 year later.
- i336_ 9y ago
  Interesting. What'd you find? :)
  - carvalho 9y ago
    Apparently I was part of a test where input sanitization was turned off. Reported and fixed before they could push it live. Very "monkey on a typewriter". I was not even looking for security bugs, but studying usage of maia.css. http://aster.or.jp/conference/icst2017/program/jmicco-keynote.pdf http://aster.or.jp/conference/icst2017/program/jmicco-keynot...

sushid 9y ago

Google's known for their fast triage/response time. They're also fairly generous with their bounties.

nodesocket 9y ago

Where is this resentment and skepticism coming from? The facts say otherwise. Google is known to be receptive to bounties and payout.

to3m 9y ago
Most of their consumer-facing services are not, shall we say, famous for being high-touch... But presumably different people look after the security side of things.
kristianp 9y ago
This story from yesterday has raised some resentment about google's support: A startup’s Firebase bill suddenly increased from $25 to $1750 per month https://news.ycombinator.com/item?id=14356409 https://news.ycombinator.com/item?id=14356409
- joatmon-snoo 9y ago
  Their customer/enterprise support is notoriously sketchy, at least from the outside (a la HN) looking in. That's not the same at all as their bug bounty program, which is generally one of the best out there.

carvalho 9y ago

Depending on the severity of your finding, your report could wake up a senior security engineer. When your report is out of scope, Google will not ignore your report. When there is a non-serious bug, you get acknowleged in the bug report they file internally. Finally, when they can not replicate your finding, they will communicate that with you and stay patient until they can either replicate or close your report. Edit: forgot to add that they raised the bounty with another 2k ("we updated our payouts") and they invited me to their Blackhat booth 1 year later.

i336_ 9y ago
Interesting. What'd you find? :)
- carvalho 9y ago
  Apparently I was part of a test where input sanitization was turned off. Reported and fixed before they could push it live. Very "monkey on a typewriter". I was not even looking for security bugs, but studying usage of maia.css. http://aster.or.jp/conference/icst2017/program/jmicco-keynote.pdf http://aster.or.jp/conference/icst2017/program/jmicco-keynot...