6 ms·

If the vulnerability is still there, and you find and report it, you should be paid the bounty regardless of whether or not you were first. This should give com

If the vulnerability is still there, and you find and report it, you should be paid the bounty regardless of whether or not you were first. This should give companies a further incentive to close the vulnerability as quickly as possible. Isn’t the point supposed to be to discourage black hats from acting on vulnerabilities they find? If only the first person to find the bug is awarded the bounty and all others are told “tough shit” this really doesn’t solve that problem.

SCHiM 6y ago
As a hacker, I see a very easily exploitable flaw in your proposed solution :)
- saagarjha 6y ago
  Sadly, the solution to Sybil attacks is generally either exclusivity or proof-of-work…
tptacek 6y ago
Most companies don't do bounties at all (and arguably they shouldn't). The idea that the companies that do are going to 2-3-4x pay the same bounty on a bug collision is unrealistic. The "fair" thing here is probably to split the bounty among the discoverers, but that's not going to happen either.
- f- 6y ago
  If you do that, you're merely trading one grievance for another: "evil company marked my bug as duplicate to avoid paying" for "evil company claimed to have gotten duplicate reports to weasel out of paying the full amount". More people upset, although individually, maybe to a lesser extent. The core issue is not the reward division algorithm, it's the inherent lack of visibility. One solution here would be to just open all reports after a while, but this creates problems of its own. One is that it gives ammo to people engaging in dishonest or clueless PR. Another is that some researchers don't actually want visibility, because their employers have murky rules around such engagements, or because they have some far-off disclosure timeline in mind (as a part of a presentation at a conference, or whatnot).
  - paulryanrogers 6y ago
    How about dividing among reporters, bounty increases the longer it's not fixed since first report, and those paid must be publicly acknowledged. Probably also need stiff penalties for insiders who might conspire to notify others of bugs and split the pay out.
    - craftinator 6y ago
      The trouble with your first point is that companies won't go for it; no point in having HackerOne around if no one will use their platform. It's a tricky problem; let's solve it with AI and Blockchain!
      - paulryanrogers 6y ago
        Why not divide the payout? The companies paying will pay the same amount, just divided among all the reporters. They already do the work of identifying duplicate reports. Maybe it could be weighted to pay more to the first reporter. As far as not doing it. At some point critical industries may be have to be regulated to force them to behave responsibly.
    - tptacek 6y ago
      Nobody is going to do anything like this. Bug fixes take time to coordinate and deploy, and nobody is going to make themselves and their schedules accountable to some random bug bounty submitter. At the point where you're doing this, you might as well just engage professional pentesters; they don't give a shit when you ship fixes --- you just pay them to find bugs and write them up.
  - yardstick 6y ago
    How about combining reward splitting with having some way to show a count of recent submissions (no details, just count), so people know before submitting that there is a chance someone else already submitted the issue. Or a mechanism for companies that use email to register the researchers submissions in HackerOne. The details will be sealed and non-public, with researchers having no way to know it exists unless the company provides a link to it as proof of work. HackerOne thus acts as a kind of notary against accusations from researchers that it wasn’t really a duplicate.
- Bnshsysjab 6y ago
  Do that and a bad actor would just use multiple accounts to report to take a bigger chunk of the pool
  - tptacek 6y ago
    Someone's going to create multiple bank accounts to fight for a bigger slice of the $50 they're contending for on an open redirect finding? This sounds like a concern that is plausible mostly on a message board.
    - a_t48 6y ago
      I have multiple bank accounts. And I can get my friends on it.
      - tptacek 6y ago
        That sounds like a super good use of your time and I wish you the best of luck.
        retsibsi 6y ago
        This sarcasm seems misplaced. How much effort does it take to share the details of a bug with friends? Not to mention that some bounties are much greater than $50.
        Bnshsysjab 6y ago
        Particularly when you have a syndicate. You find a bug? Share it with the group, they find one and share it back. Now you have two smaller pieces of the pie that cumulatively are bigger than your initial piece. And some payouts are 10k, I’ve never even heard of $50 minimums, I thought it’s either $100 or swag.
- kelnos 6y ago
  > Most companies don't do bounties at all (and arguably they shouldn't) Out of curiosity, why shouldn't they? Is it because they then end up with a lot of garbage/spam submissions to sort through from people hoping to trick the company into paying out a bounty?
  - tptacek 6y ago
    Yes, and they're a less time-efficient way to get a serious read-out of application security than a pentest is. A lot of companies run bounties because they think they're "supposed to", but really, no.

SCHiM 6y ago

As a hacker, I see a very easily exploitable flaw in your proposed solution :)

saagarjha 6y ago
Sadly, the solution to Sybil attacks is generally either exclusivity or proof-of-work…

tptacek 6y ago

Most companies don't do bounties at all (and arguably they shouldn't). The idea that the companies that do are going to 2-3-4x pay the same bounty on a bug collision is unrealistic. The "fair" thing here is probably to split the bounty among the discoverers, but that's not going to happen either.

f- 6y ago
If you do that, you're merely trading one grievance for another: "evil company marked my bug as duplicate to avoid paying" for "evil company claimed to have gotten duplicate reports to weasel out of paying the full amount". More people upset, although individually, maybe to a lesser extent. The core issue is not the reward division algorithm, it's the inherent lack of visibility. One solution here would be to just open all reports after a while, but this creates problems of its own. One is that it gives ammo to people engaging in dishonest or clueless PR. Another is that some researchers don't actually want visibility, because their employers have murky rules around such engagements, or because they have some far-off disclosure timeline in mind (as a part of a presentation at a conference, or whatnot).
- paulryanrogers 6y ago
  How about dividing among reporters, bounty increases the longer it's not fixed since first report, and those paid must be publicly acknowledged. Probably also need stiff penalties for insiders who might conspire to notify others of bugs and split the pay out.
  - craftinator 6y ago
    The trouble with your first point is that companies won't go for it; no point in having HackerOne around if no one will use their platform. It's a tricky problem; let's solve it with AI and Blockchain!
    - paulryanrogers 6y ago
      Why not divide the payout? The companies paying will pay the same amount, just divided among all the reporters. They already do the work of identifying duplicate reports. Maybe it could be weighted to pay more to the first reporter. As far as not doing it. At some point critical industries may be have to be regulated to force them to behave responsibly.
  - tptacek 6y ago
    Nobody is going to do anything like this. Bug fixes take time to coordinate and deploy, and nobody is going to make themselves and their schedules accountable to some random bug bounty submitter. At the point where you're doing this, you might as well just engage professional pentesters; they don't give a shit when you ship fixes --- you just pay them to find bugs and write them up.
- yardstick 6y ago
  How about combining reward splitting with having some way to show a count of recent submissions (no details, just count), so people know before submitting that there is a chance someone else already submitted the issue. Or a mechanism for companies that use email to register the researchers submissions in HackerOne. The details will be sealed and non-public, with researchers having no way to know it exists unless the company provides a link to it as proof of work. HackerOne thus acts as a kind of notary against accusations from researchers that it wasn’t really a duplicate.
Bnshsysjab 6y ago
Do that and a bad actor would just use multiple accounts to report to take a bigger chunk of the pool
- tptacek 6y ago
  Someone's going to create multiple bank accounts to fight for a bigger slice of the $50 they're contending for on an open redirect finding? This sounds like a concern that is plausible mostly on a message board.
  - a_t48 6y ago
    I have multiple bank accounts. And I can get my friends on it.
    - tptacek 6y ago
      That sounds like a super good use of your time and I wish you the best of luck.
      - retsibsi 6y ago
        This sarcasm seems misplaced. How much effort does it take to share the details of a bug with friends? Not to mention that some bounties are much greater than $50.
        Bnshsysjab 6y ago
        Particularly when you have a syndicate. You find a bug? Share it with the group, they find one and share it back. Now you have two smaller pieces of the pie that cumulatively are bigger than your initial piece. And some payouts are 10k, I’ve never even heard of $50 minimums, I thought it’s either $100 or swag.
kelnos 6y ago
> Most companies don't do bounties at all (and arguably they shouldn't) Out of curiosity, why shouldn't they? Is it because they then end up with a lot of garbage/spam submissions to sort through from people hoping to trick the company into paying out a bounty?
- tptacek 6y ago
  Yes, and they're a less time-efficient way to get a serious read-out of application security than a pentest is. A lot of companies run bounties because they think they're "supposed to", but really, no.