3 ms·
Respectfully disagree with this one. We don't even have a bounty program, and we get at least 10 non-issues for every actual potentially exploitable report. I
by Taek 7y ago
Respectfully disagree with this one. We don't even have a bounty program, and we get at least 10 non-issues for every actual potentially exploitable report.
I can definitely see someone reviewing this and accidentally putting it in the "not a problem" bucket. From our perspective, the best vulnerability reports look like:
"This potential exploit can crash your node"
"This potential exploit can steal user funds"
Etc.
It really helps us filter through the nonsense reports we get.
- kidintech 7y agoWhile I can see what you're saying, you also have to properly compute, on your end, a cost for a False Positive and a cost for a False Negative. In my opinion, in the case of security, I think a False Negative should weigh a lot, and thus measures to prevent it should be in place (i.e. not having an intern mindlessly looking through issues and sorting them into buckets). Of course, the cost of each will depend on your app/company, its industry, its size, and so on.