5 ms·
At least hackerone still feels focused around disclosure so if you have a dupe you get linked to the original report. With bugcrowd you can get closed as dupli
by eterm 8y ago
At least hackerone still feels focused around disclosure so if you have a dupe you get linked to the original report.
With bugcrowd you can get closed as duplicate and never get to see the original report so just have to trust it's really a dupe.
With hackerone you can push for disclosure which puts a clock on companies (unless they completely disappear from the platform which has happened).
Neither feel like a route to riches but both are good for finding companies which probably won't aggressively react to researchers finding something.
Both major platforms feel like they've lost momentum though, on both platforms though it feels like there isn't much in-flow of new companies, and on bugcrowd most companies go through private programs first which really limits how much you can find as a casual well-meaning amateur. The participating companies probably get a better experience that way but the early days of hackerone were more fun.
- tptacek 8y agoMost H1 companies start "private" as well; the impression, and H1 amplifies it, is that the general public bounty programs are really noisy.
- RyJones 8y agoMy experience is hackerone reports are almost 100% low effort spam, managed in an opaque manner. I would not choose it as a platform for a new bug bounty program.
- tptacek 8y agoThat is not at all my experience with H1, and we manage (and have managed) a bunch of H1 programs for our clients. I wouldn't advise most startups to do bug bounty programs at all, but if I was, I'd recommend H1.
- RyJones 8y agoYou have more experience than I have, obviously, because I'm only involved in running one bounty program on H1. I have not been impressed with H1. Perhaps my opinion will change as our program matures, but I am not optimistic. I think there's a lot of space in this market for competition. I suspect if I was driving as much revenue as you are, they might be more responsive. That's life.
- tptacek 8y agoI mean, I don't know what the problems you had were. I look at H1 like a loot box in a game like, I don't know, Team Fortress 2. Most of the time you get a bunch of lame stuff. Every once in awhile, no matter how you structure your program or how much you pay, you get an excellent bluebird bug. In a twist on how "real" loot boxes work, sometimes you get bullshit that wastes your time. I wouldn't pay a lot of money for access to those loot boxes, but for what they are, they're fine, and I think H1 does a good job of presenting and managing it. I am not a believer in the sales pitch that different bug bounty sites have materially different cohorts of testers. The people you really want to attract probably aren't affiliated with any particular bounty site.