5 ms·

This article is a) very long and written mostly as a whitepaper/opinion piece and less of a journalistic report b) it's very likely a paid hit piece against bug

This article is a) very long and written mostly as a whitepaper/opinion piece and less of a journalistic report b) it's very likely a paid hit piece against bug bounty companies. However, I'm not surprised as the timing makes sense. The COVID-19 situ has impacted a lot of pen-testing firms [canceled testing contracts/security staff augmentation, longterm security audits] and it's expensive AF for these companies to keep their consultants on bench. Bug bounties are by no means perfect, but whatever this article is trying to point out isn't going to stop CISO's from doubling down on bug bounties. In fact, CISO's who've been skeptic about BBs will be now be pressed to explore this option even more. About Me: Sold a few security startups, before that worked as the head of app sec testing for a bailed out british investment bank.

tptacek 7y ago
Who would pay to put a hit piece on bug bounty providers? What pentesting firm do you think has their shit together to the extent that they run a media relations team? Who among them don't have revenue streams from triage consulting? It's a bad article. CSO publishes a lot of bad articles. But there's no way this is a paid piece. The people quoted in this article believe what they're saying.
- gyanchawdhary 7y ago
  > has their shit together to the extent that they run a media relations team. Any company that drops cool research (ATM / Automotive hacking / SCADA etc) use PR firms to drum up their work (which is fair IMHO for SEO/showcasing your new capabilities and service offerings). I did it and I know loads of boutique firms in the UK who do it. I also know of education companies working closely with PR firms to publish articles about "cybersecurity skills gap" or "cybersecurity shortage" to manufacture and invent demand and they are pretty effective too. So it's not that outlandish to think that security companies aren't tactical enough to have PR companies write such articles either. My suspicion about this specific article was given its timing. > Who among them don't have revenue streams from triage consulting? Trigale Consulting is good money but it's mostly getting crumbs from the master's table. BB's are at the apex of this pyramid and will continue to do so. Sharp boutique firms that specialize in stuff will obviously always thrive but that's a diff topic >It's a bad article. CSO publishes a lot of bad articles. Agree > But there's no way this is a paid piece. Maybe but I'm still doubtful. > The people quoted in this article believe what they're saying. Fair point.
  - lvh 7y ago
    I'm quoted in the article. I was not paid for it. I am a practitioner, and I believe what I am saying. Which, to reiterate succinctly, is: - Bug bounties are a waste of time and money for most startups, because you will drown in nonsense scanner findings. - There is a straightforward explanation in which HackerOne benefits from that dynamic, and their business model incentivizes them to make that dynamic worse, not better. I would be happy to debate those points, but frankly they don't seem that controversial. While I am not speaking for Latacora in the article, I obviously make money when Latacora does, so your claim warrants analysis. Latacora's business model is long term proxies for an initial security hire. It does not include "triage consulting" as a revenue line item. We do not do one-off 2x2 pentests. There is relatively little overlap between our clientele (startups considering their first security hire) and the companies spending a lot of money on bug bounties. Most of our clients do not, and generally should not, host bug bounties. For clients that do, we operate the program, but do not bill separately for that service. Therefore Latacora's financial incentive would clearly be to have H1 run the program with triage, because it straightforwardly removes a cost. Our business incentives are aligned with security outcomes, because we stick around long enough for the impact of our choices. I think bug bounties are fine for a subset of customers. Given the size of our consultancy and our customer base and the somewhat obvious fact we're resource constrained in scaling, it's fairly clear I have no financial stake in this: people do not buy more Latacora because they bought less HackerOne. I can't speak for HackerOne, but I can't imagine they think we're a competing service, not do we think the converse. COVID-19 has impacted a lot of consultancies. It has also made stock markets overall drop 30%, so the suggestion that this article is some kind of consultancy cabal master plan to screw over bug bounty programs specifically I think requires a more evidence to be credible. As Thomas has pointed out: the idea that this is some kind of PR campaign does not pass the sniff test. Our headcount is a baker's dozen. We do not employ a PR firm. You're probably right that, say, NCC does, perhaps NCC considers themselves a proxy good for H1, but no NCC representative is quoted in the article. Moussouris is a former executive and current shareholder of HackerOne. It's true that she is still in the bug bounty business! But if you look at how their business is structured, it emphasizes fewer, larger corps and governments and longer-term engagements with a strong compliance and legal focus. Whatever upside she gets from bug bounties being painted in a positive light but HackerOne in a negative one (stipulating this article does that, which I think is questionable), does not weigh up to the clear likely financial incentive she does have where HackerOne does extraordinarily well, IPOs, and her shares turn liquid and she gets a big payday. Do you have evidence that is not the case? I don't really see how the legal experts in the article taking the position that e.g. these bug bounty companies regularly violate AB-5 unless they mean it. Perhaps they are getting paid, but that's a pretty serious allegation I haven't seen any evidence for. And, if they're just in it for the money, wouldn't it be much easier for them to take it from the allegedly-violating side and argue _their_ case? The contractor-turned-employee side isn't exactly where the money is, and I can't imagine whatever the going rate for a quote is is the most effective way for a lawyer to make money. (Regardless, I am not a legal expert, and AB-5 violations are not part of my argument--the extent of my argument is that "this is a paid hit piece" seems unlikely for them.)
djannzjkzxn 7y ago
> it's very likely a paid hit piece against bug bounty companies. A thought on the incentives behind such a paid piece. There is a big free rider problem here. All pentesters, or all opponents of big bounty programs, would benefits equally from a hit piece, or to be more specific, would benefit proportionally to their market share. So suspicion on who would pay for a hit piece should fall mostly on entities who control a substantial portion of the market share, or some kind of lobbying organization/cartel representing multiple entities that add up to a substantial market share. Or some entity that makes a financially bad decision and ignores the free rider problem to fund the hit piece - but at that point, you don’t need the hit piece to be paid at all. It’s just ideologically motivated.
- gyanchawdhary 7y ago
  Perhaps. I’m inclined to see this opinion piece, through the lens of “Wittgenstein’s Ruler”: If you use a ruler to measure a table, you may also use the table to measure the ruler.

tptacek 7y ago

Who would pay to put a hit piece on bug bounty providers? What pentesting firm do you think has their shit together to the extent that they run a media relations team? Who among them don't have revenue streams from triage consulting? It's a bad article. CSO publishes a lot of bad articles. But there's no way this is a paid piece. The people quoted in this article believe what they're saying.

gyanchawdhary 7y ago
> has their shit together to the extent that they run a media relations team. Any company that drops cool research (ATM / Automotive hacking / SCADA etc) use PR firms to drum up their work (which is fair IMHO for SEO/showcasing your new capabilities and service offerings). I did it and I know loads of boutique firms in the UK who do it. I also know of education companies working closely with PR firms to publish articles about "cybersecurity skills gap" or "cybersecurity shortage" to manufacture and invent demand and they are pretty effective too. So it's not that outlandish to think that security companies aren't tactical enough to have PR companies write such articles either. My suspicion about this specific article was given its timing. > Who among them don't have revenue streams from triage consulting? Trigale Consulting is good money but it's mostly getting crumbs from the master's table. BB's are at the apex of this pyramid and will continue to do so. Sharp boutique firms that specialize in stuff will obviously always thrive but that's a diff topic >It's a bad article. CSO publishes a lot of bad articles. Agree > But there's no way this is a paid piece. Maybe but I'm still doubtful. > The people quoted in this article believe what they're saying. Fair point.
- lvh 7y ago
  I'm quoted in the article. I was not paid for it. I am a practitioner, and I believe what I am saying. Which, to reiterate succinctly, is: - Bug bounties are a waste of time and money for most startups, because you will drown in nonsense scanner findings. - There is a straightforward explanation in which HackerOne benefits from that dynamic, and their business model incentivizes them to make that dynamic worse, not better. I would be happy to debate those points, but frankly they don't seem that controversial. While I am not speaking for Latacora in the article, I obviously make money when Latacora does, so your claim warrants analysis. Latacora's business model is long term proxies for an initial security hire. It does not include "triage consulting" as a revenue line item. We do not do one-off 2x2 pentests. There is relatively little overlap between our clientele (startups considering their first security hire) and the companies spending a lot of money on bug bounties. Most of our clients do not, and generally should not, host bug bounties. For clients that do, we operate the program, but do not bill separately for that service. Therefore Latacora's financial incentive would clearly be to have H1 run the program with triage, because it straightforwardly removes a cost. Our business incentives are aligned with security outcomes, because we stick around long enough for the impact of our choices. I think bug bounties are fine for a subset of customers. Given the size of our consultancy and our customer base and the somewhat obvious fact we're resource constrained in scaling, it's fairly clear I have no financial stake in this: people do not buy more Latacora because they bought less HackerOne. I can't speak for HackerOne, but I can't imagine they think we're a competing service, not do we think the converse. COVID-19 has impacted a lot of consultancies. It has also made stock markets overall drop 30%, so the suggestion that this article is some kind of consultancy cabal master plan to screw over bug bounty programs specifically I think requires a more evidence to be credible. As Thomas has pointed out: the idea that this is some kind of PR campaign does not pass the sniff test. Our headcount is a baker's dozen. We do not employ a PR firm. You're probably right that, say, NCC does, perhaps NCC considers themselves a proxy good for H1, but no NCC representative is quoted in the article. Moussouris is a former executive and current shareholder of HackerOne. It's true that she is still in the bug bounty business! But if you look at how their business is structured, it emphasizes fewer, larger corps and governments and longer-term engagements with a strong compliance and legal focus. Whatever upside she gets from bug bounties being painted in a positive light but HackerOne in a negative one (stipulating this article does that, which I think is questionable), does not weigh up to the clear likely financial incentive she does have where HackerOne does extraordinarily well, IPOs, and her shares turn liquid and she gets a big payday. Do you have evidence that is not the case? I don't really see how the legal experts in the article taking the position that e.g. these bug bounty companies regularly violate AB-5 unless they mean it. Perhaps they are getting paid, but that's a pretty serious allegation I haven't seen any evidence for. And, if they're just in it for the money, wouldn't it be much easier for them to take it from the allegedly-violating side and argue _their_ case? The contractor-turned-employee side isn't exactly where the money is, and I can't imagine whatever the going rate for a quote is is the most effective way for a lawyer to make money. (Regardless, I am not a legal expert, and AB-5 violations are not part of my argument--the extent of my argument is that "this is a paid hit piece" seems unlikely for them.)

djannzjkzxn 7y ago

> it's very likely a paid hit piece against bug bounty companies. A thought on the incentives behind such a paid piece. There is a big free rider problem here. All pentesters, or all opponents of big bounty programs, would benefits equally from a hit piece, or to be more specific, would benefit proportionally to their market share. So suspicion on who would pay for a hit piece should fall mostly on entities who control a substantial portion of the market share, or some kind of lobbying organization/cartel representing multiple entities that add up to a substantial market share. Or some entity that makes a financially bad decision and ignores the free rider problem to fund the hit piece - but at that point, you don’t need the hit piece to be paid at all. It’s just ideologically motivated.

gyanchawdhary 7y ago
Perhaps. I’m inclined to see this opinion piece, through the lens of “Wittgenstein’s Ruler”: If you use a ruler to measure a table, you may also use the table to measure the ruler.