5 ms·

I don't run a bug bounty but I do sit on a security@ inbox. I don't believe I've ever seen a report I would want to pay out on even if I could, but if you disco

I don't run a bug bounty but I do sit on a security@ inbox. I don't believe I've ever seen a report I would want to pay out on even if I could, but if you discount blatant spam (often peddling EV certificates), I've received reports asking about bounties for: - nginx version disclosed in headers - "Feature-Policy" header missing - DNSSEC not set up on zone - Domain not in HSTS preload list Responding to this sort of thing with "not a vulnerability" is intensely difficult because the of the potential for a PR backlash about "poor security" from people who just don't know better, particularly when the company is definitely not a tech company.

kiliankoe 8y ago
If I remember correctly VLC regularly receives bug bounty reports declaring it as a security vulnerability that their source code is available...
- HenryBemis 8y ago
  And for softwares like VLC that have a special place in our hearts ('K-Lite Codec Pack' [1] was my special friend until the moment I discovered VLC many-many years ago), there is or there should be a firewall rule that says Enabled-Block-Any-Any-In&Out. [1]: https://www.codecguide.com/download_kl.htm https://www.codecguide.com/download_kl.htm Ps: remember those days that we were looking for codecs for our Windows Players back in the Win95-98-2000-XP days???
ancarda 8y ago
If you were to do some of these (like removing the nginx version), do you think they'd start demanding payment?
deytempo 8y ago
Just silence the version header advertisement for the web servers. Make them actually test for vulnerabilities not just check the version
kbenson 8y ago
I remember back in the day I used to field security scan reports for a client I consulted for, and the amount of things I had to mark as "not actually a problem" because all they did was check Apache header versions was staggering. This is slightly better than and slightly worse than your situation at the same time. Slightly better in that they were looking for versions that had actual exploits known in them, but slightly worse in that they had no way to deal with distros that back-patched for vulnerabilities, like RHEL (which was the distro in question). "Yes, I'm aware that that the version of Apache you are noting contains a vulnerability. No, it's not actually a problem or exploitable, since I already applied the patched update. Just like last week. And the week before that."

kiliankoe 8y ago

If I remember correctly VLC regularly receives bug bounty reports declaring it as a security vulnerability that their source code is available...

HenryBemis 8y ago
And for softwares like VLC that have a special place in our hearts ('K-Lite Codec Pack' [1] was my special friend until the moment I discovered VLC many-many years ago), there is or there should be a firewall rule that says Enabled-Block-Any-Any-In&Out. [1]: https://www.codecguide.com/download_kl.htm https://www.codecguide.com/download_kl.htm Ps: remember those days that we were looking for codecs for our Windows Players back in the Win95-98-2000-XP days???

ancarda 8y ago

If you were to do some of these (like removing the nginx version), do you think they'd start demanding payment?

deytempo 8y ago

Just silence the version header advertisement for the web servers. Make them actually test for vulnerabilities not just check the version

kbenson 8y ago

I remember back in the day I used to field security scan reports for a client I consulted for, and the amount of things I had to mark as "not actually a problem" because all they did was check Apache header versions was staggering. This is slightly better than and slightly worse than your situation at the same time. Slightly better in that they were looking for versions that had actual exploits known in them, but slightly worse in that they had no way to deal with distros that back-patched for vulnerabilities, like RHEL (which was the distro in question). "Yes, I'm aware that that the version of Apache you are noting contains a vulnerability. No, it's not actually a problem or exploitable, since I already applied the patched update. Just like last week. And the week before that."