10 ms·
Stories like this are wonderful evidence of the effectiveness of public disclosure of security vulnerabilities, and are always heartwarming to see. Remember, 90
by akersten 7y ago
Stories like this are wonderful evidence of the effectiveness of public disclosure of security vulnerabilities, and are always heartwarming to see. Remember, 90-day disclosure windows are just a courtesy.
- Sahhaese 7y agoThis is why I consider bug bounty programs problematic, because they've been co-opted from a system to manage responsible disclosure to a system to contain and manage non-disclosure.
- vorpalhex 7y agoBug bounty programs can be great tools to help reward researchers, secure products and help align new and amateur researchers who may not have ever reported a bug before to standards. But like all things, they can also be used to keep software insecure, hide issues, and instead buy off researchers.
- lamby 7y agoMmm. This post by Matthew Garrett is good on this: https://mjg59.dreamwidth.org/52432.html https://mjg59.dreamwidth.org/52432.html