3 ms·
This concerns the bug bounty itself: Is there a Dropbox internal bug bounty program as well? As data is unencrypted, I assume the biggest thread to customer dat
by I_am_tiberius 9y ago
This concerns the bug bounty itself: Is there a Dropbox internal bug bounty program as well? As data is unencrypted, I assume the biggest thread to customer data are Dropbox employees.
- notsofastbuddy 9y agoI don't know of any company that publicly advertises the bonuses they give (if any) to employees for finding vulnerabilities in their own software. That seems more like part of someone's job description.
- jessaustin 9y agoYeah the incentives get very murky very quickly there. One employee might ignore a vuln now so as to get a bounty for it later. A manager might give a known vuln-maker code access. Any group of employees might conspire to do either of those or something else at some remove. An actual attacker might manipulate any such conspiracy... It might be interesting as a study of Gambit Roulette, but not as any way to run a firm. It's possible that GP meant giving independent researchers access to internal tools. That would be interesting but also very difficult to pull off safely.
- I_am_tiberius 9y agoYes, but it would be even more important. Employees have access to system architecture details which makes it easier for them to harm users.
- deleted 9y ago[deleted]