4 ms·

Then next time someone finds an Amazon bug, they should release it 0-day on their blog for the lulz^H^H^H^H credit. Or sell it to someone who can make use of i

by clubm8 8y ago

Then next time someone finds an Amazon bug, they should release it 0-day on their blog for the lulz^H^H^H^H credit. Or sell it to someone who can make use of it. It's incredibly entitled for a company to not run a bug bounty program then complain when people drop 0-days on their github blogs.

StavrosK 8y ago
If you find that someone forgot their car door open, do you deserve money for not telling thieves where you can find a car with an open door? Bug bounties are a good incentive for hardening your security, but is exploiting flaws the moral thing to do by default? Does there need to be a monetary incentive for people to do the right thing? I run a service that has a few users and makes about $200/mo. Someone once emailed me that they found a bug and whether I run a bug bounty program. I told them I couldn't really afford one and they never replied. Are they now morally justified to publicize the flaw?
- anoncake 8y ago
  You can't afford aa bug bounty program. Amazon can.
  - StavrosK 8y ago
    Does that make it moral for someone to disclose the bug? "This parking lot leaves cars unlocked, but since they seem busy and aren't paying me not to, it's okay if I tell thieves about it".
    - anoncake 8y ago
      Telling thieves in particular? Absolutely not. Telling everyone (unfortunately including thieves)? I think it is. Such negligence should be disclosed.
- bfrydl 8y ago
  Your analogy has cause and effect reversed. The correct analogy is that if I know there is a reward for telling people their car doors are open, I will go around town specifically looking for open car doors. With no reward, I'm just going to go about my life not even looking at car doors. Your service may be too small for this, but a company like Amazon typically saves money overall by running a bug bounty program because uncaught bugs can be extremely expensive.
  - StavrosK 8y ago
    The GP said "the next time someone finds a bug", ie the assumption is that a bug has been found. They didn't talk about whether bugs would be found or not.
- warent 8y ago
  Selling zero day exploits is an amoral act. That being said, your analogy is broken and doesn't fit here at all. First, parking lots are passive and have no intelligence. Amazon is neither of those things. Also, there are no such people who dedicate their career to lawfully testing the security of parking lots in exchange for money. In the real world of mega corporation technology (which is almost as different from a parking lot as you can get) there are countless black hats motivated by money to steal from Amazon, and countless grey hats who would help combat or mitigate the issues if properly compensated. White hats are the rare exception and report issues even without compensation. There are numerous grey hats who: 1) If there is a bug bounty program, would report the issue to be fixed 2) else, would ignore the issue entirely. You know this is true because you experienced it yourself. The difference is you can't afford the service of a grey hat. So forget the morality of these hackers. Amazon refusing to pay out a bug bounty program is amoral. Because what you're seeing is Amazon trading the security of their customers, and for what? Greed and hubris it seems.
- clubm8 8y ago
  >If you find that someone forgot their car door open, do you deserve money for not telling thieves where you can find a car with an open door? Conversely, if you accuse the person who tells you the door is open of stealing from you and threaten to call the police, should you really be surprised if next time that happens they tell someone, maybe in exchange for a cut of the profit?
- mpweiher 8y ago
  > their car door open, Not at all similar. One is leaving open the door to your own car. The other is someone who is being entrusted with keeping something safe for third parties "leaving the door open", i.e. being in breach of that trust, and essentially saying that they don't give a frack about their infraction. So how can Amazon be sanctioned for this infraction? While I also don't see "breaking in" as necessarily a great option, it may be less bad than letting Amazon just get away with it. Unless there is a good way to fine or otherwise sanction Amazon, I am not sure there is an actual good option.
deleted 8y ago
[deleted]
jcims 8y ago
Sorry, that's ridiculous and borderline extortion. Sounds like protection money for the mob. If there's any entitlement, it's within the small but vocal subset of security researchers that feel that unsolicited bug finding should be compensated under threat of public disclosure.

by clubm8 8y ago

StavrosK 8y ago

If you find that someone forgot their car door open, do you deserve money for not telling thieves where you can find a car with an open door? Bug bounties are a good incentive for hardening your security, but is exploiting flaws the moral thing to do by default? Does there need to be a monetary incentive for people to do the right thing? I run a service that has a few users and makes about $200/mo. Someone once emailed me that they found a bug and whether I run a bug bounty program. I told them I couldn't really afford one and they never replied. Are they now morally justified to publicize the flaw?

anoncake 8y ago
You can't afford aa bug bounty program. Amazon can.
- StavrosK 8y ago
  Does that make it moral for someone to disclose the bug? "This parking lot leaves cars unlocked, but since they seem busy and aren't paying me not to, it's okay if I tell thieves about it".
  - anoncake 8y ago
    Telling thieves in particular? Absolutely not. Telling everyone (unfortunately including thieves)? I think it is. Such negligence should be disclosed.
bfrydl 8y ago
Your analogy has cause and effect reversed. The correct analogy is that if I know there is a reward for telling people their car doors are open, I will go around town specifically looking for open car doors. With no reward, I'm just going to go about my life not even looking at car doors. Your service may be too small for this, but a company like Amazon typically saves money overall by running a bug bounty program because uncaught bugs can be extremely expensive.
- StavrosK 8y ago
  The GP said "the next time someone finds a bug", ie the assumption is that a bug has been found. They didn't talk about whether bugs would be found or not.
warent 8y ago
Selling zero day exploits is an amoral act. That being said, your analogy is broken and doesn't fit here at all. First, parking lots are passive and have no intelligence. Amazon is neither of those things. Also, there are no such people who dedicate their career to lawfully testing the security of parking lots in exchange for money. In the real world of mega corporation technology (which is almost as different from a parking lot as you can get) there are countless black hats motivated by money to steal from Amazon, and countless grey hats who would help combat or mitigate the issues if properly compensated. White hats are the rare exception and report issues even without compensation. There are numerous grey hats who: 1) If there is a bug bounty program, would report the issue to be fixed 2) else, would ignore the issue entirely. You know this is true because you experienced it yourself. The difference is you can't afford the service of a grey hat. So forget the morality of these hackers. Amazon refusing to pay out a bug bounty program is amoral. Because what you're seeing is Amazon trading the security of their customers, and for what? Greed and hubris it seems.
clubm8 8y ago
>If you find that someone forgot their car door open, do you deserve money for not telling thieves where you can find a car with an open door? Conversely, if you accuse the person who tells you the door is open of stealing from you and threaten to call the police, should you really be surprised if next time that happens they tell someone, maybe in exchange for a cut of the profit?
mpweiher 8y ago
> their car door open, Not at all similar. One is leaving open the door to your own car. The other is someone who is being entrusted with keeping something safe for third parties "leaving the door open", i.e. being in breach of that trust, and essentially saying that they don't give a frack about their infraction. So how can Amazon be sanctioned for this infraction? While I also don't see "breaking in" as necessarily a great option, it may be less bad than letting Amazon just get away with it. Unless there is a good way to fine or otherwise sanction Amazon, I am not sure there is an actual good option.

deleted 8y ago

[deleted]

jcims 8y ago

Sorry, that's ridiculous and borderline extortion. Sounds like protection money for the mob. If there's any entitlement, it's within the small but vocal subset of security researchers that feel that unsolicited bug finding should be compensated under threat of public disclosure.