3 ms·

I mean, it’s a total auth bypass in GitHub by simply sending a HEAD request, with a one line fix. The turnaround time shows that they have the ability to evalua

by zaroth 7y ago

I mean, it’s a total auth bypass in GitHub by simply sending a HEAD request, with a one line fix. The turnaround time shows that they have the ability to evaluate a serious report through HackerOne quickly, they have a dedicated engineer who could get in and make the one line fix, and they have the ability to deploy new code quickly. All good things! I am mostly impressed that they paid out $25k in under a week. That’s a sign of not just a good engineering setup, but some good bureaucracy as well.

_jal 7y ago
Perhaps it does merely reduce to "being competent". But the contrast with nearly every other vendor out there is stark. Been managing GHE for years, and I have been consistently impressed with Github's code quality, competence, and even product management (nearly every time I think, "there should be a way to...", there already is). From the outside, at least, they look like the model to emulate for this sort of application.
- jrochkind1 7y ago
  You're both right, competency is in fact really damn impressive. (I have come to think, as a software engineer, that we've comuterized so much of social life such that our economy literally could not afford it if it wasn't mostly crap).
Tijdreiziger 7y ago
It doesn't say they paid out yet, just that they 'awarded' the bounty, which could just be GitHub telling HackerOne they intend to pay without actually having moved any money yet.
- mtnGoat 7y ago
  Regardless, the fact that someone at Github can approve such a large payment so quickly, is still impressive.
  - NightlyDev 7y ago
    I don't think $25k is a large payment in githubs eyes. There are much smaller companies that doesn't even blink spending ten times as much. And this was definitely approved before they went out and told people what they would pay for different bugs.
spullara 7y ago
How long until someone is coding up a minivan? https://dilbert.com/strip/1995-11-13 https://dilbert.com/strip/1995-11-13

by zaroth 7y ago

_jal 7y ago

Perhaps it does merely reduce to "being competent". But the contrast with nearly every other vendor out there is stark. Been managing GHE for years, and I have been consistently impressed with Github's code quality, competence, and even product management (nearly every time I think, "there should be a way to...", there already is). From the outside, at least, they look like the model to emulate for this sort of application.

jrochkind1 7y ago
You're both right, competency is in fact really damn impressive. (I have come to think, as a software engineer, that we've comuterized so much of social life such that our economy literally could not afford it if it wasn't mostly crap).

Tijdreiziger 7y ago

It doesn't say they paid out yet, just that they 'awarded' the bounty, which could just be GitHub telling HackerOne they intend to pay without actually having moved any money yet.

mtnGoat 7y ago
Regardless, the fact that someone at Github can approve such a large payment so quickly, is still impressive.
- NightlyDev 7y ago
  I don't think $25k is a large payment in githubs eyes. There are much smaller companies that doesn't even blink spending ten times as much. And this was definitely approved before they went out and told people what they would pay for different bugs.

spullara 7y ago

How long until someone is coding up a minivan? https://dilbert.com/strip/1995-11-13 https://dilbert.com/strip/1995-11-13