3 ms·

I'm very happy for the kid and like the idea that these programs are available but does this incentivise companies to effectively outsource their bug finding?

• xfitm3 8y ago
  You still neee security engineers to operate the program.
• cgb223 8y ago
  When your company is as massive as something like google and you have nation states, groups, and individuals literally trying to hack you every few minutes, it’s definitely more financially viable to have a full time security team Outsourcing bug finding is only a retroactive solution, not a proactive one
• Sebb767 8y ago
  Because a bug bounty does not guarantee that people actually look into your code. Of course some white hats while invest time upfront, but there is no guarantee and absence of payed bounties is not evidence of absence of bugs. Also, a bug bounty usually limits the scope a lot more than a typical pentest does, i.e. no testing of infrastructure security, internal networks etc.. Lastly, if your bug bounty is high enough to make highly skilled people spent time to find your bugs its probably cheaper to just higher some security folks yourself and prevent excessive payouts (by preventing bugs). Of course all of this does not stop some C-levels from using a bug bounty as replacement, but the issue is not as clear cut and especially the last point should even make sense to non-technical people.
• badfrog 8y ago
  Why not both? The bounties are great for finding things your security team might not think about or might consider low-pri, but having a dedicated team is important to make sure you've got the core use cases covered.
  • deleted 8y ago
    [deleted]
• tru3_power 8y ago
  Believe me- these programs don’t even scratch the surface of the amount of security vulns companies have hiding in their code base. Having a good bug bounty program, internal product security team and a continuous third party audit process are all parts of having a good security posture.
• yaleman 8y ago
  Only the biggest companies can really afford to have the scale and skill available from the vast range of people working for bug bounty money - and as one of the other posters mentioned - you still have to have internal staff to confirm and patch the bugs. It's almost like the best side of outsourcing, where the outsourced talent is driven to do their best work because otherwise they'll never get paid. Then again, I can imagine some teams would get utterly spammed with inane, wrong or non-bounty-able reports, which could be an issue.
• patio11 8y ago
  No serious company makes that choice, which misunderstands what companies use bug bounties for. Google, for example, pays out bug bounties regularly, but their main security expense is wages/etc of security professionals, and that is probably in the neighborhood of a billion dollars a year.
• geofft 8y ago
  This is similar to Katie Moussouris's argument from the article: > Moussouris, who created the bug bounty at Microsoft, warned that if badly implemented such programmes could see talent leaving organisations in favour of pursuing bug bounties, and thus damage the talent pipeline. I've seen her argue this on Twitter before - the argument IIRC is that bug bounties should always pay less than getting a job helping the blue team / writing secure code in the first place, otherwise the incentives are all wrong. It's great that you know about bugs, but it would be better not to have them. And, also, there's a bit of a prisoner's dilemma involved in that you don't want to let the rest of the industry drive up the expected payouts of bug bounties beyond the expected salaries of secure developers, but you also don't want to lose out on vulnerability reports either.
  • yen223 8y ago
    Step one: Work at a company with a bug bounty program Step two: Introduce subtle vulnerabilities Step three: Claim bug bounty under a pseudonym (or just get someone else to claim it)
    • nickpsecurity 8y ago
      That's actually a great spin on old concept of subversion. I wonder if anyone is doing it. It should be easier for C apps where someone could say they didn't know about a specific kind of undefined behavior.
• mattigames 8y ago
  So what? Nearly every advance of technology and management is in one way or another making more job positions irrelevant, if we want to tackle the ultimate consequence of leaving people without a living wave then we should tackle that problem directly instead of complaining when companies try to use cheaper alternatives to their problems.