4 ms·

> In good faith or otherwise, the site demands you assume good faith of the people you're arguing with. You cannot do that while calling people's statements "mo

> In good faith or otherwise, the site demands you assume good faith of the people you're arguing with. You cannot do that while calling people's statements "motivated". So what I'm hearing you say is that a quoted person's motivations aren't up for discussion in the comments section when they're posted as an article on this site. > It would be similarly unfair for me to go look you up and call your affiliations into question. That's totally fine, I follow you on twitter, you can look up my linkedin, I'm not exactly making a secret of anything here. > In reality, the quality of bug bounty reports across all these platforms is a running industry joke. Maybe internally amongst the incumbents but the industry is growing. > I laughed audibly at the sentence in your post where you implied that P0 and Bugcrowd were organizations of similar stature and repute. I don't understand how you got that out of me saying I can understand why both those groups refused to talk to this journalist.

tptacek 7y ago
The "industry" has had many years to grow, and what I see recently is the same as what I saw years ago: DKIM spam and redirect filter bypasses for long-defunct versions of Firefox. I am not aware of any shift in the perception of bounty submission quality, where people in the field are now saying "huh, suddenly the bounty inbounds we're getting tend to be legitimate and interesting". If that were happening, it would be newsworthy.
- tomlockwood 7y ago
  > I am not aware of any shift in the perception of bounty submission quality, Sure, we agree on that, but that doesn't mean these companies aren't growing - let me be more explicit here - financially. It'll be newsworthy if the perception "in the field" of required bounty submission quality doesn't match what clients will actually happily accept and pay out, won't it?
  - tptacek 7y ago
    I see you trying to walk this back, but to be clear: you wrote pretty directly as if there was no incentive for bounty participants to submit bogus bounty reports --- practically in those words --- and, obviously, the exact opposite is self-evidently true to anyone who has ever managed a bounty program. You could have just written that the article was bad. You'd have been right! But instead you wrote a long comment about how everybody quoted in the piece was talking their book, and then doubled down with some crazy assertions.
    - tomlockwood 7y ago
      It isn't in bounty hunter's interest to submit bogus reports. Where have I said it doesn't happen, regardless? I even said at one point, in response to you, directly: > That makes it even less attractive for bounty hunters to spam low-quality reports. The "less" there definitely doesn't imply that there are no low-quality reports. Bounty hunters absolutely spam low-quality reports, and there are consequences for that. Sorry if that wasn't clear. > But instead you wrote a long comment about how everybody quoted in the piece was talking their book, Two people and the author. "Everybody" is hyperbolic and I think the article makes some good points. > crazy assertions Didn't you think I consider GOOGLE's Project Zero to be an equivalent organisation to Bugcrowd? Were you suggesting it was against the rules to question the motivation of people quoted in articles on hackernews? idk
      - lvh 7y ago
        (Full disclosure: I am the Latacora person quoted in the article. While I didn't coordinate my quote w/ Latacora and speak only for myself, I've documented elsewhere in the comments[0] why I think the idea that Latacora and by proxy I would stand to financially benefit from HackerOne failing doesn't hold water, so I won't repeat that here, but I'm happy to have that argument there if you'd like.) > It isn't in bounty hunter's interest to submit bogus reports. Where have I said it doesn't happen, regardless? They clearly do: companies pay out for (and H1 triage regularly fails to filter) complete nonsense findings to the tune of several hundreds of dollars or more. If you can weaponize that process, you can make a decent chunk of change. There's also no real reputational damage, as long as it remains trivial to Sybil all of the platforms. The platforms are disincentivized to stop that, because anecdotally "number of hackers on platform" is a stat that plays really well in their sales process, and it's a drum they beat loudly. Finally, if you agree that it happens all the time, why do people keep doing that if it is truly against their interests? [0]: https://news.ycombinator.com/item?id=22779086 https://news.ycombinator.com/item?id=22779086

tptacek 7y ago

The "industry" has had many years to grow, and what I see recently is the same as what I saw years ago: DKIM spam and redirect filter bypasses for long-defunct versions of Firefox. I am not aware of any shift in the perception of bounty submission quality, where people in the field are now saying "huh, suddenly the bounty inbounds we're getting tend to be legitimate and interesting". If that were happening, it would be newsworthy.

tomlockwood 7y ago
> I am not aware of any shift in the perception of bounty submission quality, Sure, we agree on that, but that doesn't mean these companies aren't growing - let me be more explicit here - financially. It'll be newsworthy if the perception "in the field" of required bounty submission quality doesn't match what clients will actually happily accept and pay out, won't it?
- tptacek 7y ago
  I see you trying to walk this back, but to be clear: you wrote pretty directly as if there was no incentive for bounty participants to submit bogus bounty reports --- practically in those words --- and, obviously, the exact opposite is self-evidently true to anyone who has ever managed a bounty program. You could have just written that the article was bad. You'd have been right! But instead you wrote a long comment about how everybody quoted in the piece was talking their book, and then doubled down with some crazy assertions.
  - tomlockwood 7y ago
    It isn't in bounty hunter's interest to submit bogus reports. Where have I said it doesn't happen, regardless? I even said at one point, in response to you, directly: > That makes it even less attractive for bounty hunters to spam low-quality reports. The "less" there definitely doesn't imply that there are no low-quality reports. Bounty hunters absolutely spam low-quality reports, and there are consequences for that. Sorry if that wasn't clear. > But instead you wrote a long comment about how everybody quoted in the piece was talking their book, Two people and the author. "Everybody" is hyperbolic and I think the article makes some good points. > crazy assertions Didn't you think I consider GOOGLE's Project Zero to be an equivalent organisation to Bugcrowd? Were you suggesting it was against the rules to question the motivation of people quoted in articles on hackernews? idk
    - lvh 7y ago
      (Full disclosure: I am the Latacora person quoted in the article. While I didn't coordinate my quote w/ Latacora and speak only for myself, I've documented elsewhere in the comments[0] why I think the idea that Latacora and by proxy I would stand to financially benefit from HackerOne failing doesn't hold water, so I won't repeat that here, but I'm happy to have that argument there if you'd like.) > It isn't in bounty hunter's interest to submit bogus reports. Where have I said it doesn't happen, regardless? They clearly do: companies pay out for (and H1 triage regularly fails to filter) complete nonsense findings to the tune of several hundreds of dollars or more. If you can weaponize that process, you can make a decent chunk of change. There's also no real reputational damage, as long as it remains trivial to Sybil all of the platforms. The platforms are disincentivized to stop that, because anecdotally "number of hackers on platform" is a stat that plays really well in their sales process, and it's a drum they beat loudly. Finally, if you agree that it happens all the time, why do people keep doing that if it is truly against their interests? [0]: https://news.ycombinator.com/item?id=22779086 https://news.ycombinator.com/item?id=22779086