3 ms·

(Full disclosure: I am the Latacora person quoted in the article. While I didn't coordinate my quote w/ Latacora and speak only for myself, I've documented else

by lvh 7y ago

(Full disclosure: I am the Latacora person quoted in the article. While I didn't coordinate my quote w/ Latacora and speak only for myself, I've documented elsewhere in the comments[0] why I think the idea that Latacora and by proxy I would stand to financially benefit from HackerOne failing doesn't hold water, so I won't repeat that here, but I'm happy to have that argument there if you'd like.) > It isn't in bounty hunter's interest to submit bogus reports. Where have I said it doesn't happen, regardless? They clearly do: companies pay out for (and H1 triage regularly fails to filter) complete nonsense findings to the tune of several hundreds of dollars or more. If you can weaponize that process, you can make a decent chunk of change. There's also no real reputational damage, as long as it remains trivial to Sybil all of the platforms. The platforms are disincentivized to stop that, because anecdotally "number of hackers on platform" is a stat that plays really well in their sales process, and it's a drum they beat loudly. Finally, if you agree that it happens all the time, why do people keep doing that if it is truly against their interests? [0]: https://news.ycombinator.com/item?id=22779086 https://news.ycombinator.com/item?id=22779086

tomlockwood 7y ago
> The platforms are disincentivized to stop that, because anecdotally "number of hackers on platform" is a stat that plays really well in their sales process, and it's a drum they beat loudly. Anecdotally, the "number of hackers on platform" number is a statistic that causes consternation within the bug bounty community, specifically the number spruiked by some players. > They clearly do: companies pay out for (and H1 triage regularly fails to filter) complete nonsense findings to the tune of several hundreds of dollars or more. I said this elsewhere: > I think this perception might be because H1 didn't provide triaging for a while, but I think the situation is much better now. I'm absolutely sure there are still issues. I can't speak to the H1 process because I've never worked with it. I'm not here to wildly gesticulate at H1 like they're bad, though. I want them to do well. But have you tried Bugcrowd? I hear its laughable to compare them to Google Project Zero, but they've been nice to me, so yeah. I don't think either you or your colleague are really owed any gentleness from me at this point, so: I think you should both expect people to question your motivations if you get quoted in articles about another section of your own industry. I think you're both incredibly naive if you think bug bounty providers are systemically benefitting from the reputational damage the perception, that bug bounty reports are automatically generated script-kiddie outputs, delivers. I also think that you both need to cultivate a rudimentary understanding of how journalism works. Journalists are paid, almost entirely, by advertisers. Journalists get information from their contacts in the industry. Call of Duty gets great reviews in part because game journalists want to keep getting invited back to events, and because they know the ads for the game aren't likely to run next to a negative review. Hey, perhaps you did legitimately believe what you said in the article. But the journalist involved was motivated by many other things, and you may have been a useful... uhhh... something-or-other in the service of their greater agenda, keeping their advertisers coming back. Who would advertise on a website called CSO online, you ask....? I think we can both agree that people on bb platforms can be total amateurs. Gotta start somewhere.
- tptacek 7y ago
  I have no idea if bounty providers are benefiting from the spray-and-pray bogus submissions that characterize the majority of all bounty submissions. I rather expect that they aren't, and that they're a scourge for everyone involved (other than the sprayers themselves). But you didn't say "these submissions are bad". You said no incentive caused them to exist at all. As I've said repeatedly, without even a faint rebuttal: you can't ever have managed a bug bounty program and believe that statement is true. It is a crazy thing to say. I honestly don't give a shit about "CSO Online" (I had no idea anyone from Latacora was quoted in it). As you saw upthread: I think this is a dumb article. But your response to it managed, somehow, to be even dumber, and that's what we're litigating now.
  - tomlockwood 7y ago
    Could you, the guy who assumed I was directly comparing a relatively small startup with Google and uproariously laughed at that comparison, quote me on where I said "no incentive caused them to exist at all"?
    - wglb 7y ago
      Could you maybe give this a rest? The continued presumption of bad faith is objectionable and not consistent with expected standards of this site. And it is boring.

by lvh 7y ago

tomlockwood 7y ago

> The platforms are disincentivized to stop that, because anecdotally "number of hackers on platform" is a stat that plays really well in their sales process, and it's a drum they beat loudly. Anecdotally, the "number of hackers on platform" number is a statistic that causes consternation within the bug bounty community, specifically the number spruiked by some players. > They clearly do: companies pay out for (and H1 triage regularly fails to filter) complete nonsense findings to the tune of several hundreds of dollars or more. I said this elsewhere: > I think this perception might be because H1 didn't provide triaging for a while, but I think the situation is much better now. I'm absolutely sure there are still issues. I can't speak to the H1 process because I've never worked with it. I'm not here to wildly gesticulate at H1 like they're bad, though. I want them to do well. But have you tried Bugcrowd? I hear its laughable to compare them to Google Project Zero, but they've been nice to me, so yeah. I don't think either you or your colleague are really owed any gentleness from me at this point, so: I think you should both expect people to question your motivations if you get quoted in articles about another section of your own industry. I think you're both incredibly naive if you think bug bounty providers are systemically benefitting from the reputational damage the perception, that bug bounty reports are automatically generated script-kiddie outputs, delivers. I also think that you both need to cultivate a rudimentary understanding of how journalism works. Journalists are paid, almost entirely, by advertisers. Journalists get information from their contacts in the industry. Call of Duty gets great reviews in part because game journalists want to keep getting invited back to events, and because they know the ads for the game aren't likely to run next to a negative review. Hey, perhaps you did legitimately believe what you said in the article. But the journalist involved was motivated by many other things, and you may have been a useful... uhhh... something-or-other in the service of their greater agenda, keeping their advertisers coming back. Who would advertise on a website called CSO online, you ask....? I think we can both agree that people on bb platforms can be total amateurs. Gotta start somewhere.

tptacek 7y ago
I have no idea if bounty providers are benefiting from the spray-and-pray bogus submissions that characterize the majority of all bounty submissions. I rather expect that they aren't, and that they're a scourge for everyone involved (other than the sprayers themselves). But you didn't say "these submissions are bad". You said no incentive caused them to exist at all. As I've said repeatedly, without even a faint rebuttal: you can't ever have managed a bug bounty program and believe that statement is true. It is a crazy thing to say. I honestly don't give a shit about "CSO Online" (I had no idea anyone from Latacora was quoted in it). As you saw upthread: I think this is a dumb article. But your response to it managed, somehow, to be even dumber, and that's what we're litigating now.
- tomlockwood 7y ago
  Could you, the guy who assumed I was directly comparing a relatively small startup with Google and uproariously laughed at that comparison, quote me on where I said "no incentive caused them to exist at all"?
  - wglb 7y ago
    Could you maybe give this a rest? The continued presumption of bad faith is objectionable and not consistent with expected standards of this site. And it is boring.