6 ms·

Frankly, I think HackerOne deserves a bit of blame for that. Any WONTFIX ought to be made public automatically unless there are extenuating circumstances (like

Frankly, I think HackerOne deserves a bit of blame for that. Any WONTFIX ought to be made public automatically unless there are extenuating circumstances (like the vulnerability being reported against the wrong product).

deleted 7y ago
[deleted]
daeken 7y ago
H1 itself has no WONTFIX status, FYI. A bug that's not considered to be a bug by the program will either be closed N/A or informative. Ultimately, disclosures are handled and controlled by the program, not by H1; this is both a good and bad thing (and I say that as both a HackerOne employee and a hacker on the platform -- it's a complicated issue from both sides).
- kop316 7y ago
  It's complicated on both sides means there is politics involved. Being blunt, that sounds like a cop out to me. This sounds to me like an edge case that H1 should address if it really wants to be taken seriously.
  - daeken 7y ago
    There is definitely politics involved, but not H1 internal. The issue is that every program handles disclosure itself, so H1 itself doesn't really have the power. That could be changed at a policy level, but I'm not sure that'll happen (or should happen, honestly; I don't really know where I land on it).
    - chris_wot 7y ago
      H1 could make it a proviso if using their service that rejected but reports are automatically disclosed.
      - tptacek 7y ago
        1. The overwhelming majority of rejected H1 reports are garbage. 2. It is not the case that all reporters want their findings disclosed publicly, even if they're rejected. 3. Reporters already retain the right to publish findings however they'd like. The worst H1 or a client can do is kick you off the platform. 4. A bug bounty platform that mandated disclosure of any sort would lose all its customers to the platform that didn't have that mandate.
        awirth 7y ago
        "The worst H1 or a client can do is kick you off the platform." As a hacker on hackerone, this is not my understanding of the relationship. Generally speaking the programs give you "authorized access" under the CFAA conditional on following the disclosure guidelines. I don't know about for other countries, but for the US I'm pretty sure this means that breaking the guidelines means you've retroactively committed a felony. Now seems a little questionable about if any federal prosecutor would actually take the case, but it definitely doesn't seem like a strictly civil issue to me. Strongly agree on all other points though.
        tptacek 7y ago
        I agree, if you're testing someone else's website or servers, you should comply with the scope and disclosure rules or not do the testing, unless the vendor has something else on their website that implicitly authorizes testing (like an email address to send reports to). But that doesn't apply to Steam; nothing they write can really impact your ability to conduct security research on your own computer.
        awirth 7y ago
        Yeah, agree in this specific case about local research (baring DMCA issues). Most H1 scopes seem to be remote targets as opposed to downloadables though.
        busterarm 7y ago
        And this is why many of the researchers I know are based outside of or have left the United States and work out of places like Thailand.
    - numismatex 7y ago
      Power or not, a company line is a company line.
    - kop316 7y ago
      From what I see, your value proposition is both to bug bounty hunters and to companies who see a value in having Hackerone manage their bug bounty program. This effect (no matter the cause) of incident is about the worst thing that could happen to a company whose value proposition is that. It's like the bad old days where companies would legally threaten you if you found a bug, and from an outside perspective, Hackerone seems to promote it. If I were an ethical hacker, I'd think twice before using your bug bounty program for fear of that treatment. If I were a potential customer (or even a current customer), I don't know if I'd want to be associated with a company that tolerates veiled threats against ethical hackers. Edit: I should add from this, it actually looks like its Hackerone making the veiled legal threat: https://mobile.twitter.com/enigma0x3/status/1160961861560479744/photo/1 https://mobile.twitter.com/enigma0x3/status/1160961861560479...
  - robertony 7y ago
    You're probably outside the security sphere, but H1 is already taken seriously. There is no per-requisit for them to do so to be taken seriously as you state.
    - kop316 7y ago
      I'm not sure if you realize this, but your response comes off as gatekeeping.
- mentalBackflip 7y ago
  How is N/A not a synonym for WONTFIX? There comes a moment when inaction translates to deception, and if you need clarification for what that looks like in the wild, look no further than Facebook.
  - chrisseaton 7y ago
    I think WONTFIX is 'yes I see what you mean but we're not going to change how that works', N/A is 'this isn't relevant why are you posting it here.'
- numismatex 7y ago
  It's a cop-out, and it's because you're biased.
rodgerd 7y ago
HackerOne should be getting slated a lot more than they are. They are selling their bug bounty program to their customers (e.g. Valve) as offering the equivalent control to a traditional pen test contract (with confidentiality) while also trying to sell the spec work/no findings, no pay price advantage of a bug bounty program. It's scummy as hell.
- tptacek 7y ago
  If you don't want to participate in bug bounties, don't participate in them. It's not like it's hard out there in 2019 for application pentesters. This is a "world's tiniest violin" argument.
  - linza 7y ago
    It's still interesting to hear comments like in the GP for an unknowing person like me. Your comment is interesting as well, if only for the defensive reaction without addressing the "being scummy" claim. I'm basically hearing, yeah it's scummy, now get off my lawn.
  - rodgerd 7y ago
    I guess if you don't have an argument, "hurr durr angry pen tester" is what you bring to the party. (I'm not.)

deleted 7y ago

[deleted]

daeken 7y ago

H1 itself has no WONTFIX status, FYI. A bug that's not considered to be a bug by the program will either be closed N/A or informative. Ultimately, disclosures are handled and controlled by the program, not by H1; this is both a good and bad thing (and I say that as both a HackerOne employee and a hacker on the platform -- it's a complicated issue from both sides).

kop316 7y ago
It's complicated on both sides means there is politics involved. Being blunt, that sounds like a cop out to me. This sounds to me like an edge case that H1 should address if it really wants to be taken seriously.
- daeken 7y ago
  There is definitely politics involved, but not H1 internal. The issue is that every program handles disclosure itself, so H1 itself doesn't really have the power. That could be changed at a policy level, but I'm not sure that'll happen (or should happen, honestly; I don't really know where I land on it).
  - chris_wot 7y ago
    H1 could make it a proviso if using their service that rejected but reports are automatically disclosed.
    - tptacek 7y ago
      1. The overwhelming majority of rejected H1 reports are garbage. 2. It is not the case that all reporters want their findings disclosed publicly, even if they're rejected. 3. Reporters already retain the right to publish findings however they'd like. The worst H1 or a client can do is kick you off the platform. 4. A bug bounty platform that mandated disclosure of any sort would lose all its customers to the platform that didn't have that mandate.
      - awirth 7y ago
        "The worst H1 or a client can do is kick you off the platform." As a hacker on hackerone, this is not my understanding of the relationship. Generally speaking the programs give you "authorized access" under the CFAA conditional on following the disclosure guidelines. I don't know about for other countries, but for the US I'm pretty sure this means that breaking the guidelines means you've retroactively committed a felony. Now seems a little questionable about if any federal prosecutor would actually take the case, but it definitely doesn't seem like a strictly civil issue to me. Strongly agree on all other points though.
        tptacek 7y ago
        I agree, if you're testing someone else's website or servers, you should comply with the scope and disclosure rules or not do the testing, unless the vendor has something else on their website that implicitly authorizes testing (like an email address to send reports to). But that doesn't apply to Steam; nothing they write can really impact your ability to conduct security research on your own computer.
        awirth 7y ago
        Yeah, agree in this specific case about local research (baring DMCA issues). Most H1 scopes seem to be remote targets as opposed to downloadables though.
        busterarm 7y ago
        And this is why many of the researchers I know are based outside of or have left the United States and work out of places like Thailand.
  - numismatex 7y ago
    Power or not, a company line is a company line.
  - kop316 7y ago
    From what I see, your value proposition is both to bug bounty hunters and to companies who see a value in having Hackerone manage their bug bounty program. This effect (no matter the cause) of incident is about the worst thing that could happen to a company whose value proposition is that. It's like the bad old days where companies would legally threaten you if you found a bug, and from an outside perspective, Hackerone seems to promote it. If I were an ethical hacker, I'd think twice before using your bug bounty program for fear of that treatment. If I were a potential customer (or even a current customer), I don't know if I'd want to be associated with a company that tolerates veiled threats against ethical hackers. Edit: I should add from this, it actually looks like its Hackerone making the veiled legal threat: https://mobile.twitter.com/enigma0x3/status/1160961861560479744/photo/1 https://mobile.twitter.com/enigma0x3/status/1160961861560479...
- robertony 7y ago
  You're probably outside the security sphere, but H1 is already taken seriously. There is no per-requisit for them to do so to be taken seriously as you state.
  - kop316 7y ago
    I'm not sure if you realize this, but your response comes off as gatekeeping.
mentalBackflip 7y ago
How is N/A not a synonym for WONTFIX? There comes a moment when inaction translates to deception, and if you need clarification for what that looks like in the wild, look no further than Facebook.
- chrisseaton 7y ago
  I think WONTFIX is 'yes I see what you mean but we're not going to change how that works', N/A is 'this isn't relevant why are you posting it here.'
numismatex 7y ago
It's a cop-out, and it's because you're biased.

rodgerd 7y ago

HackerOne should be getting slated a lot more than they are. They are selling their bug bounty program to their customers (e.g. Valve) as offering the equivalent control to a traditional pen test contract (with confidentiality) while also trying to sell the spec work/no findings, no pay price advantage of a bug bounty program. It's scummy as hell.

tptacek 7y ago
If you don't want to participate in bug bounties, don't participate in them. It's not like it's hard out there in 2019 for application pentesters. This is a "world's tiniest violin" argument.
- linza 7y ago
  It's still interesting to hear comments like in the GP for an unknowing person like me. Your comment is interesting as well, if only for the defensive reaction without addressing the "being scummy" claim. I'm basically hearing, yeah it's scummy, now get off my lawn.
- rodgerd 7y ago
  I guess if you don't have an argument, "hurr durr angry pen tester" is what you bring to the party. (I'm not.)