5 ms·

One alternative is to allow a report without full documentation and a PoC. If it’s a dupe, mark it as a dupe, otherwise ask for the full writeup. As for the pr

One alternative is to allow a report without full documentation and a PoC. If it’s a dupe, mark it as a dupe, otherwise ask for the full writeup. As for the problem of spammy submissions: charge a small nominal fee of $10 or so to submit, with a full refund if it’s a legit issue (even if it’s a duplicate).

kelnos 6y ago
Isn't that a potential information leak, though? A potential black-hat attacker could sit around and brainstorm a big list of potential vulnerabilities without going through to figure out if they exist and are exploitable. Then they can start submitting them, and if they get closed as duplicate, they can quickly dive into that one, figure out how to exploit it, and make use of it for nefarious purposes. Maybe that's a little farfetched, though.
- kerng 6y ago
  Mozilla just recently changed their program to divide bounty amongst submissions of same vuln within 3 days. Not a perfect fix, but I think it helps.
  - alasdair_ 6y ago
    >Mozilla just recently changed their program to divide bounty amongst submissions of same vuln within 3 days. One potential issue: someone on the Mozilla team could pass some of these on to a few friends who then claim some of the money. It's not a major likelihood, unless the bounties are numerous or especially large.
- mikemotherwell 6y ago
  No it's exactly the sort of thought process people have. Another scenario is someone does what you suggest after finding a real vulnerability, to waste the teams time while they exploit the real vulnerability.
  - lawnchair_larry 6y ago
    Honestly, neither of these things would ever happen. It just doesn’t work that way and wouldn’t make sense for them to go about it that way.
- alasdair_ 6y ago
  >A potential black-hat attacker could sit around and brainstorm a big list of potential vulnerabilities without going through to figure out if they exist and are exploitable. Then they can start submitting them, and if they get closed as duplicate, they can quickly dive into that one, figure out how to exploit it, and make use of it for nefarious purposes. So long as there is a big of lag before confirmation (which, in practice, there already is), the vendor would know about the issue at least several days in advance of the black-hat even getting a hint and could hopefully patch it in that time. For especially big holes, just take a bit longer than usual to get back to people until it's fixed.
rasz 6y ago
if its a dupe then that means you are sitting on unpatched live bug that I found, F you pay me.
- alasdair_ 6y ago
  >if its a dupe then that means you are sitting on unpatched live bug that I found, F you pay me. The problem is that you can just tell all your friends to file the same bug, and now they have to pay everyone?

kelnos 6y ago

Isn't that a potential information leak, though? A potential black-hat attacker could sit around and brainstorm a big list of potential vulnerabilities without going through to figure out if they exist and are exploitable. Then they can start submitting them, and if they get closed as duplicate, they can quickly dive into that one, figure out how to exploit it, and make use of it for nefarious purposes. Maybe that's a little farfetched, though.

kerng 6y ago
Mozilla just recently changed their program to divide bounty amongst submissions of same vuln within 3 days. Not a perfect fix, but I think it helps.
- alasdair_ 6y ago
  >Mozilla just recently changed their program to divide bounty amongst submissions of same vuln within 3 days. One potential issue: someone on the Mozilla team could pass some of these on to a few friends who then claim some of the money. It's not a major likelihood, unless the bounties are numerous or especially large.
mikemotherwell 6y ago
No it's exactly the sort of thought process people have. Another scenario is someone does what you suggest after finding a real vulnerability, to waste the teams time while they exploit the real vulnerability.
- lawnchair_larry 6y ago
  Honestly, neither of these things would ever happen. It just doesn’t work that way and wouldn’t make sense for them to go about it that way.
alasdair_ 6y ago
>A potential black-hat attacker could sit around and brainstorm a big list of potential vulnerabilities without going through to figure out if they exist and are exploitable. Then they can start submitting them, and if they get closed as duplicate, they can quickly dive into that one, figure out how to exploit it, and make use of it for nefarious purposes. So long as there is a big of lag before confirmation (which, in practice, there already is), the vendor would know about the issue at least several days in advance of the black-hat even getting a hint and could hopefully patch it in that time. For especially big holes, just take a bit longer than usual to get back to people until it's fixed.

rasz 6y ago

if its a dupe then that means you are sitting on unpatched live bug that I found, F you pay me.

alasdair_ 6y ago
>if its a dupe then that means you are sitting on unpatched live bug that I found, F you pay me. The problem is that you can just tell all your friends to file the same bug, and now they have to pay everyone?