7 ms·
Are you basing this opinion on this one account? I would like to point out that Uber has a history of sleaze and would absolutely not use their behavior to judg
by ztjio 9y ago
Are you basing this opinion on this one account? I would like to point out that Uber has a history of sleaze and would absolutely not use their behavior to judge any such programs. Are there other well described, similar instances of such poor behavior from legitimate companies?
It seems to me that most of the bigger corps offering bug bounties may be paying too little but at least they follow their own rules.
- bangonkeyboard 9y agoKhaos Tian published a writeup a few days ago about how he discovered a wide-open HomeKit vulnerability [0]. He reported it properly months prior, but Apple ignored his followups and was unresponsive. After this extended radio silence, Tian reached out to a media contact. Within hours of being contacted by the website, Apple finally pushed a hotfix for the vulnerability. Apple subsequently denied Tian access to their bug bounty program because going to the press "voided the qualification for the invitation." [1] [0]: https://medium.com/@khaost/your-home-was-not-so-secure-after-all-af52fbd6777c https://medium.com/@khaost/your-home-was-not-so-secure-after... [1]: https://twitter.com/KhaosT/status/943283519119179776 https://twitter.com/KhaosT/status/943283519119179776
- pixl97 9y agoAnd this kids, is why blackhats are selling your vulns to other blackhats.
- ztjio 9y agoClearly a problematic exchange, but, nowhere is it said that this is a bug bounty program interaction nor is it an account of Apple denying promised payment for such a program. I'm certainly not justifying a poor communication and response to the report, but, it seems like a very different kind of problem, and not one reflective of the kind of corporate sleaze often seen from Uber.