11 ms·

H1 itself has no WONTFIX status, FYI. A bug that's not considered to be a bug by the program will either be closed N/A or informative. Ultimately, disclosures

by daeken 7y ago

H1 itself has no WONTFIX status, FYI. A bug that's not considered to be a bug by the program will either be closed N/A or informative. Ultimately, disclosures are handled and controlled by the program, not by H1; this is both a good and bad thing (and I say that as both a HackerOne employee and a hacker on the platform -- it's a complicated issue from both sides).

kop316 7y ago
It's complicated on both sides means there is politics involved. Being blunt, that sounds like a cop out to me. This sounds to me like an edge case that H1 should address if it really wants to be taken seriously.
- daeken 7y ago
  There is definitely politics involved, but not H1 internal. The issue is that every program handles disclosure itself, so H1 itself doesn't really have the power. That could be changed at a policy level, but I'm not sure that'll happen (or should happen, honestly; I don't really know where I land on it).
  - chris_wot 7y ago
    H1 could make it a proviso if using their service that rejected but reports are automatically disclosed.
    - tptacek 7y ago
      1. The overwhelming majority of rejected H1 reports are garbage. 2. It is not the case that all reporters want their findings disclosed publicly, even if they're rejected. 3. Reporters already retain the right to publish findings however they'd like. The worst H1 or a client can do is kick you off the platform. 4. A bug bounty platform that mandated disclosure of any sort would lose all its customers to the platform that didn't have that mandate.
      - awirth 7y ago
        "The worst H1 or a client can do is kick you off the platform." As a hacker on hackerone, this is not my understanding of the relationship. Generally speaking the programs give you "authorized access" under the CFAA conditional on following the disclosure guidelines. I don't know about for other countries, but for the US I'm pretty sure this means that breaking the guidelines means you've retroactively committed a felony. Now seems a little questionable about if any federal prosecutor would actually take the case, but it definitely doesn't seem like a strictly civil issue to me. Strongly agree on all other points though.
        tptacek 7y ago
        I agree, if you're testing someone else's website or servers, you should comply with the scope and disclosure rules or not do the testing, unless the vendor has something else on their website that implicitly authorizes testing (like an email address to send reports to). But that doesn't apply to Steam; nothing they write can really impact your ability to conduct security research on your own computer.
        awirth 7y ago
        Yeah, agree in this specific case about local research (baring DMCA issues). Most H1 scopes seem to be remote targets as opposed to downloadables though.
        busterarm 7y ago
        And this is why many of the researchers I know are based outside of or have left the United States and work out of places like Thailand.
        tptacek 7y ago
        I'm having trouble thinking of a single researcher that has left the US for legal reasons. There are lots of researchers now in Southeast Asia! But that's because bounty programs like H1 let those people work remotely.
  - numismatex 7y ago
    Power or not, a company line is a company line.
  - kop316 7y ago
    From what I see, your value proposition is both to bug bounty hunters and to companies who see a value in having Hackerone manage their bug bounty program. This effect (no matter the cause) of incident is about the worst thing that could happen to a company whose value proposition is that. It's like the bad old days where companies would legally threaten you if you found a bug, and from an outside perspective, Hackerone seems to promote it. If I were an ethical hacker, I'd think twice before using your bug bounty program for fear of that treatment. If I were a potential customer (or even a current customer), I don't know if I'd want to be associated with a company that tolerates veiled threats against ethical hackers. Edit: I should add from this, it actually looks like its Hackerone making the veiled legal threat: https://mobile.twitter.com/enigma0x3/status/1160961861560479744/photo/1 https://mobile.twitter.com/enigma0x3/status/1160961861560479...
- robertony 7y ago
  You're probably outside the security sphere, but H1 is already taken seriously. There is no per-requisit for them to do so to be taken seriously as you state.
  - kop316 7y ago
    I'm not sure if you realize this, but your response comes off as gatekeeping.
mentalBackflip 7y ago
How is N/A not a synonym for WONTFIX? There comes a moment when inaction translates to deception, and if you need clarification for what that looks like in the wild, look no further than Facebook.
- chrisseaton 7y ago
  I think WONTFIX is 'yes I see what you mean but we're not going to change how that works', N/A is 'this isn't relevant why are you posting it here.'
numismatex 7y ago
It's a cop-out, and it's because you're biased.

by daeken 7y ago

kop316 7y ago

It's complicated on both sides means there is politics involved. Being blunt, that sounds like a cop out to me. This sounds to me like an edge case that H1 should address if it really wants to be taken seriously.

daeken 7y ago
There is definitely politics involved, but not H1 internal. The issue is that every program handles disclosure itself, so H1 itself doesn't really have the power. That could be changed at a policy level, but I'm not sure that'll happen (or should happen, honestly; I don't really know where I land on it).
- chris_wot 7y ago
  H1 could make it a proviso if using their service that rejected but reports are automatically disclosed.
  - tptacek 7y ago
    1. The overwhelming majority of rejected H1 reports are garbage. 2. It is not the case that all reporters want their findings disclosed publicly, even if they're rejected. 3. Reporters already retain the right to publish findings however they'd like. The worst H1 or a client can do is kick you off the platform. 4. A bug bounty platform that mandated disclosure of any sort would lose all its customers to the platform that didn't have that mandate.
    - awirth 7y ago
      "The worst H1 or a client can do is kick you off the platform." As a hacker on hackerone, this is not my understanding of the relationship. Generally speaking the programs give you "authorized access" under the CFAA conditional on following the disclosure guidelines. I don't know about for other countries, but for the US I'm pretty sure this means that breaking the guidelines means you've retroactively committed a felony. Now seems a little questionable about if any federal prosecutor would actually take the case, but it definitely doesn't seem like a strictly civil issue to me. Strongly agree on all other points though.
      - tptacek 7y ago
        I agree, if you're testing someone else's website or servers, you should comply with the scope and disclosure rules or not do the testing, unless the vendor has something else on their website that implicitly authorizes testing (like an email address to send reports to). But that doesn't apply to Steam; nothing they write can really impact your ability to conduct security research on your own computer.
        awirth 7y ago
        Yeah, agree in this specific case about local research (baring DMCA issues). Most H1 scopes seem to be remote targets as opposed to downloadables though.
      - busterarm 7y ago
        And this is why many of the researchers I know are based outside of or have left the United States and work out of places like Thailand.
        tptacek 7y ago
        I'm having trouble thinking of a single researcher that has left the US for legal reasons. There are lots of researchers now in Southeast Asia! But that's because bounty programs like H1 let those people work remotely.
- numismatex 7y ago
  Power or not, a company line is a company line.
- kop316 7y ago
  From what I see, your value proposition is both to bug bounty hunters and to companies who see a value in having Hackerone manage their bug bounty program. This effect (no matter the cause) of incident is about the worst thing that could happen to a company whose value proposition is that. It's like the bad old days where companies would legally threaten you if you found a bug, and from an outside perspective, Hackerone seems to promote it. If I were an ethical hacker, I'd think twice before using your bug bounty program for fear of that treatment. If I were a potential customer (or even a current customer), I don't know if I'd want to be associated with a company that tolerates veiled threats against ethical hackers. Edit: I should add from this, it actually looks like its Hackerone making the veiled legal threat: https://mobile.twitter.com/enigma0x3/status/1160961861560479744/photo/1 https://mobile.twitter.com/enigma0x3/status/1160961861560479...
robertony 7y ago
You're probably outside the security sphere, but H1 is already taken seriously. There is no per-requisit for them to do so to be taken seriously as you state.
- kop316 7y ago
  I'm not sure if you realize this, but your response comes off as gatekeeping.

mentalBackflip 7y ago

How is N/A not a synonym for WONTFIX? There comes a moment when inaction translates to deception, and if you need clarification for what that looks like in the wild, look no further than Facebook.

chrisseaton 7y ago
I think WONTFIX is 'yes I see what you mean but we're not going to change how that works', N/A is 'this isn't relevant why are you posting it here.'

numismatex 7y ago

It's a cop-out, and it's because you're biased.