5 ms·
I think the threat of prosecution in this case is already some form of damage. Even if he is ultimately not convicted, future whitehats will think twice about c
by gota 8y ago
I think the threat of prosecution in this case is already some form of damage. Even if he is ultimately not convicted, future whitehats will think twice about coming forward because this one was _threathned_ with prosecution, thinking "what if I don't get so lucky?"
- tomp 8y agoSounds like the same thing that happened to Aaron Swartz...
- chii 8y agoThe smart thing to do, if a company has no public vulnerability bounty program, is to sell the information on the blackmarket instead. This will incentivize all companies to start their bounty program, whilst still getting some cash reward.
- mirimir 8y agoI don't know about the "sell the information on the blackmarket" part. But uninvited pen-testing seems pretty risky. Maybe it'd be prudent to have an ~anonymous pseudonym for this stuff. And if you really care about reputation building, you could use an ~anonymous pseudonym plus the sha256 or sha512 hash of some string. If it all works out, you just share the string, and reap the credit.
- giancarlostoro 8y agoI agree. No need to get way too unethical to make a buck.... Ask for Monero or something if they want the full disclosure before you publicly and anonymously do a full disclosure.
- askmike 8y agoIt might incentivize the companies to change, but it might not. Especially if you end up selling it to an entity who uses Meanwhile you are doing real damage. Why not publish the leak online to force the company to fix it asap?