6 ms·

> Bug bounty programs typically have stringent rules, disqualify many valid reports, and take a long time to pay out. When they pay out. Some will even fix the

> Bug bounty programs typically have stringent rules, disqualify many valid reports, and take a long time to pay out. When they pay out. Some will even fix the bug, and just tell you "thanks, but it wasn't a security bug"

pera 6y ago
or just tell you "what bug? lol that never happened..."
- EForEndeavour 6y ago
  Great way to alienate the hacking community. That would work only a small number of times before word spread not to bother even trying that company's disclosure program.
  - NoodleIncident 6y ago
    That's how we got here. This is the word
    - hutzlibu 6y ago
      But is it a fact, or just rumor?
      - eitland 6y ago
        It is fairly well known that certain large companies are really stingy. I'm not into this but once discovered a kind of security related bug (could reveal details about the composition of a password typed into a new Windows 8 password field, admittedly low value as you had to have the user type in the password and leave) and later found a more interesting issue in the way an official powershell module works with Azure Information Security that makes it possible to sneak a file through unencrypted. On the first I got a nice thank you mail and on the last I struggled so hard to report it that I gave up.
  - philipov 6y ago
    Well, the question was why someone wouldn't use the company's disclosure program, so that's the point.
  - cwkoss 6y ago
    Have you ever tried to participate in a bug bounty program? I've tried a couple and the experience has been consistently disappointing, but maybe there are some better ones.
hackermailman 6y ago
Exactly, it's easier to sell your bug to 'mafia boy 2020' for crypto meme tokens on some shady fraduster network than it is to fit inside the scope of the bounty offer. "This exploit is out of bounds you receive nothing thanks for your time"
- cwkoss 6y ago
  Or "This exploit is a duplicate report that we've known about for two years and still haven't gotten around to fixing."
  - nseggs 6y ago
    No to mention in this case you’re likely giving up disclosure for under $10k before taxes
redorb 6y ago
Happened to me in a minor way with ASCII chat characters running down the search engine results page into other results. I reported that you could use this to basically block out the serp and they said it wasn't a bug then fixed it.. I was hoping for a t shirt at least.. Now I wished I would've abused it and blogged about it for the resume.
- tgsovlerkhgsel 6y ago
  I'd say it's a bug, but not a security bug. Someone bragging about finding Zalgo in a SERP would not impress me when reading resumes.
- the797979 6y ago
  I found a bug (not security bug) in an apparel companies website allowing unlimited reuse of their £10 of vouchers. I reported and got a free t-shirt :)
  - ithkuil 6y ago
    If you can exploit it to make economic damage, would that count as a security bug?
    - bostik 6y ago
      Taken to logical extreme, that would make any black PR or reputational attack a security vulnerability. Infosec is certainly a hefty part of business continuity, but business continuity itself is a much wider topic.
- Thorrez 6y ago
  You can still blog about it.
- joeyrideout 6y ago
  I agree with their assessment. No sensitive data's confidentiality or integrity was impacted, and no availability impact to users.

pera 6y ago

or just tell you "what bug? lol that never happened..."

EForEndeavour 6y ago
Great way to alienate the hacking community. That would work only a small number of times before word spread not to bother even trying that company's disclosure program.
- NoodleIncident 6y ago
  That's how we got here. This is the word
  - hutzlibu 6y ago
    But is it a fact, or just rumor?
    - eitland 6y ago
      It is fairly well known that certain large companies are really stingy. I'm not into this but once discovered a kind of security related bug (could reveal details about the composition of a password typed into a new Windows 8 password field, admittedly low value as you had to have the user type in the password and leave) and later found a more interesting issue in the way an official powershell module works with Azure Information Security that makes it possible to sneak a file through unencrypted. On the first I got a nice thank you mail and on the last I struggled so hard to report it that I gave up.
- philipov 6y ago
  Well, the question was why someone wouldn't use the company's disclosure program, so that's the point.
- cwkoss 6y ago
  Have you ever tried to participate in a bug bounty program? I've tried a couple and the experience has been consistently disappointing, but maybe there are some better ones.

hackermailman 6y ago

Exactly, it's easier to sell your bug to 'mafia boy 2020' for crypto meme tokens on some shady fraduster network than it is to fit inside the scope of the bounty offer. "This exploit is out of bounds you receive nothing thanks for your time"

cwkoss 6y ago
Or "This exploit is a duplicate report that we've known about for two years and still haven't gotten around to fixing."
- nseggs 6y ago
  No to mention in this case you’re likely giving up disclosure for under $10k before taxes

redorb 6y ago

Happened to me in a minor way with ASCII chat characters running down the search engine results page into other results. I reported that you could use this to basically block out the serp and they said it wasn't a bug then fixed it.. I was hoping for a t shirt at least.. Now I wished I would've abused it and blogged about it for the resume.

tgsovlerkhgsel 6y ago
I'd say it's a bug, but not a security bug. Someone bragging about finding Zalgo in a SERP would not impress me when reading resumes.
the797979 6y ago
I found a bug (not security bug) in an apparel companies website allowing unlimited reuse of their £10 of vouchers. I reported and got a free t-shirt :)
- ithkuil 6y ago
  If you can exploit it to make economic damage, would that count as a security bug?
  - bostik 6y ago
    Taken to logical extreme, that would make any black PR or reputational attack a security vulnerability. Infosec is certainly a hefty part of business continuity, but business continuity itself is a much wider topic.
Thorrez 6y ago
You can still blog about it.
joeyrideout 6y ago
I agree with their assessment. No sensitive data's confidentiality or integrity was impacted, and no availability impact to users.