3 ms·

As an operator of many websites... I don't want more emails from "Security Researchers" who want $100 to tell me the obvious such as, "Login form should be rate

As an operator of many websites... I don't want more emails from "Security Researchers" who want $100 to tell me the obvious such as, "Login form should be rate-limited" or "emails can be enumerated using password reset form" and the like... Instead, we should have a central vulnerability repository that is open-source, standardized, public, and transparent. This repository should vet vulnerability reports before contacting the software owner prior to disclosure.

IncRnd 9y ago
> Instead, we should have a central vulnerability repository that is open-source, standardized, public, and transparent. This repository should vet vulnerability reports before contacting the software owner prior to disclosure. There are plenty of those. Generally, they take a cut of the bounty.
bzbarsky 9y ago
On the flip side, such a vulnerability repository may not have incentives aligned with either the bug reporter or the software owner. See https://palant.de/2017/10/04/observations-on-managed-bug-bounty-programs https://palant.de/2017/10/04/observations-on-managed-bug-bou... for a recent post about that sort of problem.