2 ms·

In good faith I'm addressing your comment about a security vendor's motivations. I don't really mind who it is or what industry it is. I expect a database com

In good faith I'm addressing your comment about a security vendor's motivations. I don't really mind who it is or what industry it is. I expect a database company to talk down the capabilities of other database companies, even if they sometimes use or provide that company's products.

tptacek 7y ago
In good faith or otherwise, the site demands you assume good faith of the people you're arguing with. You cannot do that while calling people's statements "motivated". I speak with some authority on Latacora's "motivations". You're wrong about them (rather the opposite motivation exists), but that's besides the point: they aren't in bounds for discussion here. It would be similarly unfair for me to go look you up and call your affiliations into question. You're wrong, quite obviously, about other things too. For instance: 'It is in the interest of nobody involved to submit "dubious" bug bounty reports'. In reality, the quality of bug bounty reports across all these platforms is a running industry joke. It's hard to believe anyone could run a public bounty program and believe that bogus reports were not a norm. They're practically all you get. (I laughed audibly at the sentence in your post where you implied that P0 and Bugcrowd were organizations of similar stature and repute).
- tomlockwood 7y ago
  > In good faith or otherwise, the site demands you assume good faith of the people you're arguing with. You cannot do that while calling people's statements "motivated". So what I'm hearing you say is that a quoted person's motivations aren't up for discussion in the comments section when they're posted as an article on this site. > It would be similarly unfair for me to go look you up and call your affiliations into question. That's totally fine, I follow you on twitter, you can look up my linkedin, I'm not exactly making a secret of anything here. > In reality, the quality of bug bounty reports across all these platforms is a running industry joke. Maybe internally amongst the incumbents but the industry is growing. > I laughed audibly at the sentence in your post where you implied that P0 and Bugcrowd were organizations of similar stature and repute. I don't understand how you got that out of me saying I can understand why both those groups refused to talk to this journalist.
  - tptacek 7y ago
    The "industry" has had many years to grow, and what I see recently is the same as what I saw years ago: DKIM spam and redirect filter bypasses for long-defunct versions of Firefox. I am not aware of any shift in the perception of bounty submission quality, where people in the field are now saying "huh, suddenly the bounty inbounds we're getting tend to be legitimate and interesting". If that were happening, it would be newsworthy.
    - tomlockwood 7y ago
      > I am not aware of any shift in the perception of bounty submission quality, Sure, we agree on that, but that doesn't mean these companies aren't growing - let me be more explicit here - financially. It'll be newsworthy if the perception "in the field" of required bounty submission quality doesn't match what clients will actually happily accept and pay out, won't it?
      - tptacek 7y ago
        I see you trying to walk this back, but to be clear: you wrote pretty directly as if there was no incentive for bounty participants to submit bogus bounty reports --- practically in those words --- and, obviously, the exact opposite is self-evidently true to anyone who has ever managed a bounty program. You could have just written that the article was bad. You'd have been right! But instead you wrote a long comment about how everybody quoted in the piece was talking their book, and then doubled down with some crazy assertions.
        tomlockwood 7y ago
        It isn't in bounty hunter's interest to submit bogus reports. Where have I said it doesn't happen, regardless? I even said at one point, in response to you, directly: > That makes it even less attractive for bounty hunters to spam low-quality reports. The "less" there definitely doesn't imply that there are no low-quality reports. Bounty hunters absolutely spam low-quality reports, and there are consequences for that. Sorry if that wasn't clear. > But instead you wrote a long comment about how everybody quoted in the piece was talking their book, Two people and the author. "Everybody" is hyperbolic and I think the article makes some good points. > crazy assertions Didn't you think I consider GOOGLE's Project Zero to be an equivalent organisation to Bugcrowd? Were you suggesting it was against the rules to question the motivation of people quoted in articles on hackernews? idk
deleted 7y ago
[deleted]

tptacek 7y ago

In good faith or otherwise, the site demands you assume good faith of the people you're arguing with. You cannot do that while calling people's statements "motivated". I speak with some authority on Latacora's "motivations". You're wrong about them (rather the opposite motivation exists), but that's besides the point: they aren't in bounds for discussion here. It would be similarly unfair for me to go look you up and call your affiliations into question. You're wrong, quite obviously, about other things too. For instance: 'It is in the interest of nobody involved to submit "dubious" bug bounty reports'. In reality, the quality of bug bounty reports across all these platforms is a running industry joke. It's hard to believe anyone could run a public bounty program and believe that bogus reports were not a norm. They're practically all you get. (I laughed audibly at the sentence in your post where you implied that P0 and Bugcrowd were organizations of similar stature and repute).

tomlockwood 7y ago
> In good faith or otherwise, the site demands you assume good faith of the people you're arguing with. You cannot do that while calling people's statements "motivated". So what I'm hearing you say is that a quoted person's motivations aren't up for discussion in the comments section when they're posted as an article on this site. > It would be similarly unfair for me to go look you up and call your affiliations into question. That's totally fine, I follow you on twitter, you can look up my linkedin, I'm not exactly making a secret of anything here. > In reality, the quality of bug bounty reports across all these platforms is a running industry joke. Maybe internally amongst the incumbents but the industry is growing. > I laughed audibly at the sentence in your post where you implied that P0 and Bugcrowd were organizations of similar stature and repute. I don't understand how you got that out of me saying I can understand why both those groups refused to talk to this journalist.
- tptacek 7y ago
  The "industry" has had many years to grow, and what I see recently is the same as what I saw years ago: DKIM spam and redirect filter bypasses for long-defunct versions of Firefox. I am not aware of any shift in the perception of bounty submission quality, where people in the field are now saying "huh, suddenly the bounty inbounds we're getting tend to be legitimate and interesting". If that were happening, it would be newsworthy.
  - tomlockwood 7y ago
    > I am not aware of any shift in the perception of bounty submission quality, Sure, we agree on that, but that doesn't mean these companies aren't growing - let me be more explicit here - financially. It'll be newsworthy if the perception "in the field" of required bounty submission quality doesn't match what clients will actually happily accept and pay out, won't it?
    - tptacek 7y ago
      I see you trying to walk this back, but to be clear: you wrote pretty directly as if there was no incentive for bounty participants to submit bogus bounty reports --- practically in those words --- and, obviously, the exact opposite is self-evidently true to anyone who has ever managed a bounty program. You could have just written that the article was bad. You'd have been right! But instead you wrote a long comment about how everybody quoted in the piece was talking their book, and then doubled down with some crazy assertions.
      - tomlockwood 7y ago
        It isn't in bounty hunter's interest to submit bogus reports. Where have I said it doesn't happen, regardless? I even said at one point, in response to you, directly: > That makes it even less attractive for bounty hunters to spam low-quality reports. The "less" there definitely doesn't imply that there are no low-quality reports. Bounty hunters absolutely spam low-quality reports, and there are consequences for that. Sorry if that wasn't clear. > But instead you wrote a long comment about how everybody quoted in the piece was talking their book, Two people and the author. "Everybody" is hyperbolic and I think the article makes some good points. > crazy assertions Didn't you think I consider GOOGLE's Project Zero to be an equivalent organisation to Bugcrowd? Were you suggesting it was against the rules to question the motivation of people quoted in articles on hackernews? idk

deleted 7y ago

[deleted]