3 ms·
> HackerOne appears to be completely broken and I wouldn't recommend it to anyone. Completely disagree with this. I launched a HackerOne program for my compan
by cj 7y ago
> HackerOne appears to be completely broken and I wouldn't recommend it to anyone.
Completely disagree with this.
I launched a HackerOne program for my company last month (for free, not using their “managed” service).
Of the many reports people submitted, we triaged 30-40 valid reports (most very minor, one or two moderate). We paid out a few thousand dollars in rewards.
At the same time, we also did a more traditional 2-week penetration test with Cobalt (https://cobalt.io/ https://cobalt.io/) that cost over $10,000, and HackerOne was the clear winner when it came to the number of high quality security reports worth fixing. And H1 was 2-3x cheaper after paying out the bounties.
I’m sure HackerOne isn’t great for all companies, but just posting this to refute the blanket statement that HackerOne is “completely broken” across the board.
- hvis 7y agoYou are not disagreeing. The grandparent is saying that H1 isn't great for researchers. For companies, it might as well be very good, both for honest ones, and ones just looking to "cover their ass".
- sneak 7y ago> And H1 was 2-3x cheaper after paying out the bounties. Perpetuating a system wherein security researchers are massively underpaid for their services because of a terrible abusive platform doesn't seem like a very nice way to do business.
- tptacek 7y agoThe platform has nothing to do with the rates; plenty of companies run bounty programs without H1, and there is a general standard range for findings across all platforms. None of these findings appear to have been worth much of anything.
- stebann 7y agoThis is not funny, many of us live in countries where we need that money. We're underpaid but we try. I'm glad that we have high quality researchers in this platforms but punishing us goes too far.
- homakov 7y agoSurprise, you don't need hacker one to get reports. sendbugshere@company.com solves the same issue without introducing a new trusted party.