3 ms·
As company you should do bug bounty but in addition, not as replacement of doing your own testing. The reason: Bug bounty is fundamentally favoring the compani
by kerng 6y ago
As company you should do bug bounty but in addition, not as replacement of doing your own testing.
The reason: Bug bounty is fundamentally favoring the companies that sign up. They pay next to nothing for getting a lot of eyes on their site and here and there a valuable find will be made.
Rewards should probably be much higher, like 10x I think to attract better researchers.
Also, the latest invention of private programs, where testers aren't even allowed to talk about it or share finds after is a joke as well - it's all just in favor of the companies. The basically buy the researchers silence, e.g. they can dismiss a find and don't pay and just say oops duplicate.
For someone skilled and interested in infosec there are better ways to make money.
- wp381640 6y agoMake your program private, increase your bounties 3-5x, put in a $1k+ first bug report bonus and invite in people who have previously reported good and/or well documented bugs and you'll save time and get a lot more out of it These free-for-all bug bounty programs are a drain on resources that could be better spent elsewhere The real value hackerone and similar should be providing is filtering out the time wasting reporters and the vendors who slow roll on reports - but they do neither of those
- lawnchair_larry 6y agoThis is correct in theory but not in practice. Commodity bug bounties have become somewhat of a failed experiment. For most companies, they cost more than they are worth, and that cost doesn’t even come from the reward payout.
- kerng 6y agoThat's a good point, but if I understand correctly Hackerone staff has to triage bugs before a company is even responding or required to look at it? So it's all offloaded, or is that incorrect?