4 ms·
HackerOne has threatened to ban researchers who disclose responsibly.
by hitekker 7y ago
HackerOne has threatened to ban researchers who disclose responsibly.
- tptacek 7y agoH1 is somewhat unlikely to ban someone who holds a real RCE in Squid for months and then publishes it, because H1 needs those people on its platform. Most H1 bounty people are just running scanners to find DKIM quirks. I think the conversation about whether H1 is problematic or not is a fine thing to have at the top of the thread. I can see people going either way on that question (bear in mind that it has as much to do with idiosyncrasies of each of H1's customers as it does with H1 themselves).