3 ms·
Do note that mtlynch is not saying that it's all the authors fault and Valve/HackerOne couldn't handle this better. What you've written can be true as at the s
by capableweb 7y ago
Do note that mtlynch is not saying that it's all the authors fault and Valve/HackerOne couldn't handle this better.
What you've written can be true as at the same time, what mtlynch has written is true too. Everyone could do better here.
But most likely, giving feedback to Valve/HackerOne via a Hacker News thread is likely to not be read. The feedback to the author is more likely to be read by the author themselves and other aspiring penetration testers.
So in the end, everyone could have done better.
- munk-a 7y agoI feel like that issue translation step is part of what HackerOne is actually there to do though - they serve as a collection and initial triaging point... if they are bad at doing a first pass of issue triaging and clarification then what are they even doing? Additionally the person at hackerone did ask for some clarification around the issue, that's great as it is helping with identification but probably also needs to encompass expressing the problem to make it clearer to read.
- capableweb 7y agoIndeed, I agree with you. Poorly handled. But that doesn't mean you as a penetration tester can do better _also_, to avoid similar future scenarios where they handle things poorly.