5 ms·

>Moreover, they didn't want me to disclose the vulnerability. At the same time, there was not even a single word from Valve. No, guys, that's not how it works.

>Moreover, they didn't want me to disclose the vulnerability. At the same time, there was not even a single word from Valve. No, guys, that's not how it works. You didn’t respect my work, and that's the reason why I won’t respect yours — I see no reason why I shouldn't publish this report. Most likely I’ll be banned at H1 because of it, but it won't make me upset. This seems pretty scammy of HackerOne and does nothing but hurt security. Either something is an issue and should be paid for, or it's not an issue and disclosure is fine. They're trying to have it both ways and trying to strong arm researchers into keeping quiet.

Sahhaese 7y ago
I've mentioned before how disappointed I've been to watch hackerone move from a platform helping responsible disclosure to a platform helping companies hide vulnerabilities. It used to be that even accepted bugs and paid bounties would be publically disclosed. It helped me learn a ton just from reading the (partially redacted) bug reports. Over time they became more and more redacted until they were left entirely pointless. To mark a bug as N/A, declare it 'not fix' but then say also it can't be disclosed is precisely why responsible disclosure is a thing. Companies can't have their cake and eat it.
- lawnchair_larry 7y ago
  This is why “responsible disclosure” has been rejected as a term among security professionals for many years now. Vendors invented it for self-serving reasons. https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coordinated-vulnerability-disclosure-bringing-balance-to-the-force/ https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coor...
SpicyLemonZest 7y ago
I think there's a fair question to ask here: is HackerOne a bug bounty program that offers security consulting services, or a security consulting service that's implemented as crowdsourced bug bounties? If I hire a normal security consultant, and she finds an issue in my product that I don't agree is a real vulnerability, it's absolutely not fine for her to go write a public article about it.
- Draiken 7y ago
  Serious question: why? Unless the company is lying and it IS a real vulnerability, writing an article about it seems harmless to me. OFC that if I planned on writing an article I'd be open about it beforehand, but that feels like a courtesy and not an obligation unless an NDA is involved. Disclaimer: I don't work in security so this is purely curiosity.
  - FDSGSG 7y ago
    An NDA is always involved. And even if not, badmouthing your customers is bad business.
    - gtirloni 7y ago
      Are they really customers?
      - FDSGSG 7y ago
        If we're talking about normal security consultants and not h1, yes?
  - SpicyLemonZest 7y ago
    It'd be like writing public articles attacking your company's accounting practices. Sometimes things are so bad it's fair to blow the whistle, but it creates nasty incentives if companies can't perform private security investigations without risking a public shaming over the results.
    - gtirloni 7y ago
      These people are not employees. They don't agree to amounts before starting the work. They don't make promises. Nothing! I don't see how someone publishing something in that situation is a problem. Like OP wrote in this thread, it either is a vulnerability or it's not. In the latter case, just assume it's the cost of doing business and people will write "bad" things about your product?
deleted 7y ago
[deleted]
diafygi 7y ago
What are the alternatives for HackerOne for hosting a bug bounty program? My company is looking to set one up and H1 was way too expensive and tried to push all their extra features. All we want is a place to host a bug bounty page and allow us to pay rewards through it. The only reason I'd prefer hosting that on a platform rather than just making a bug bounty page on our own site is that I feel bounty hunters would trust it more, since it's not just some random page on a company website they've never heard of before.

Sahhaese 7y ago

I've mentioned before how disappointed I've been to watch hackerone move from a platform helping responsible disclosure to a platform helping companies hide vulnerabilities. It used to be that even accepted bugs and paid bounties would be publically disclosed. It helped me learn a ton just from reading the (partially redacted) bug reports. Over time they became more and more redacted until they were left entirely pointless. To mark a bug as N/A, declare it 'not fix' but then say also it can't be disclosed is precisely why responsible disclosure is a thing. Companies can't have their cake and eat it.

lawnchair_larry 7y ago
This is why “responsible disclosure” has been rejected as a term among security professionals for many years now. Vendors invented it for self-serving reasons. https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coordinated-vulnerability-disclosure-bringing-balance-to-the-force/ https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coor...

SpicyLemonZest 7y ago

I think there's a fair question to ask here: is HackerOne a bug bounty program that offers security consulting services, or a security consulting service that's implemented as crowdsourced bug bounties? If I hire a normal security consultant, and she finds an issue in my product that I don't agree is a real vulnerability, it's absolutely not fine for her to go write a public article about it.

Draiken 7y ago
Serious question: why? Unless the company is lying and it IS a real vulnerability, writing an article about it seems harmless to me. OFC that if I planned on writing an article I'd be open about it beforehand, but that feels like a courtesy and not an obligation unless an NDA is involved. Disclaimer: I don't work in security so this is purely curiosity.
- FDSGSG 7y ago
  An NDA is always involved. And even if not, badmouthing your customers is bad business.
  - gtirloni 7y ago
    Are they really customers?
    - FDSGSG 7y ago
      If we're talking about normal security consultants and not h1, yes?
- SpicyLemonZest 7y ago
  It'd be like writing public articles attacking your company's accounting practices. Sometimes things are so bad it's fair to blow the whistle, but it creates nasty incentives if companies can't perform private security investigations without risking a public shaming over the results.
  - gtirloni 7y ago
    These people are not employees. They don't agree to amounts before starting the work. They don't make promises. Nothing! I don't see how someone publishing something in that situation is a problem. Like OP wrote in this thread, it either is a vulnerability or it's not. In the latter case, just assume it's the cost of doing business and people will write "bad" things about your product?

deleted 7y ago

[deleted]

diafygi 7y ago

What are the alternatives for HackerOne for hosting a bug bounty program? My company is looking to set one up and H1 was way too expensive and tried to push all their extra features. All we want is a place to host a bug bounty page and allow us to pay rewards through it. The only reason I'd prefer hosting that on a platform rather than just making a bug bounty page on our own site is that I feel bounty hunters would trust it more, since it's not just some random page on a company website they've never heard of before.