3 ms·

Zed Shaw is a very clever man. However, I've read the site time and time again and I'm not sure what problem this is supposed to solve. There are already servi

by iuguy 16y ago

Zed Shaw is a very clever man. However, I've read the site time and time again and I'm not sure what problem this is supposed to solve. There are already services that pay you to disclose your vulnerabilities to them and project manage the whole thing with the vendor for you, such as Tipping Point, The Zero Day Initiative and iDefense. The whole SSL thing is a clever little hack, but is more of a solution in search of a problem. For a security researcher, secure comms with a vendor is hardly a problem that hasn't already been solved (and if the vendor wants to communicate over unencrypted SMTP and they're aware of the risks that come with it, then it's their own fault if somehow the comms are compromised). I'm sure it'll be another very smart and funky thing from Zed, but I don't see why people would use it over something that pays them for bugs.

zedshaw 16y ago
That's a really good point. I'd be competing with companies that pay people to give them defects, which is really hard to go against. I sure don't have the money to do it, so maybe this would just be for open source projects at first.
- iuguy 16y ago
  Interesting. What if you flip it around? Instead of making it something for researchers to use and competing with tipping point et al, how about making it something for open source projects to use to manage the process of handling security bugs? I'm not aware of anything in that space, but there may be some mileage in exploring it. I could see this working in a SaaS model a la github - free if you keep everything open. Paid for if you don't.
  - zedshaw 16y ago
    That's possible, and also for the SMB market that's producing lots of software but might be just a few devs. Think: iphone, ipad apps, small sites. There's not much for them either.
    - bigiain 16y ago
      Another possible angle - as Thomas points out, researchers with "reputation" don't need this. But what about up and coming researchers? Where do they "earn their rep" in the current system? I could see this maybe taking off as a way for not-yet-reputable researchers to document their history/trackrecord, in much the same way as developers can use their github repos as documentation of their programming history. Maybe in a few years time we might see junior security researchers listing their Vularb account on their resumes...
      - iuguy 16y ago
        'Up and coming' Researchers generally improve their reputation by schmoozing journalists, doing conferences and so on. If for example, you didn't want to do through someone like ZDI you could just post the bug to full disclosure. If it's a big enough bug, then the media will come to you. Unfortunately in this industry 'rep' isn't earned, it's about who shouts the loudest, and it leads to some uncomfortable situations.

by iuguy 16y ago

zedshaw 16y ago

That's a really good point. I'd be competing with companies that pay people to give them defects, which is really hard to go against. I sure don't have the money to do it, so maybe this would just be for open source projects at first.

iuguy 16y ago
Interesting. What if you flip it around? Instead of making it something for researchers to use and competing with tipping point et al, how about making it something for open source projects to use to manage the process of handling security bugs? I'm not aware of anything in that space, but there may be some mileage in exploring it. I could see this working in a SaaS model a la github - free if you keep everything open. Paid for if you don't.
- zedshaw 16y ago
  That's possible, and also for the SMB market that's producing lots of software but might be just a few devs. Think: iphone, ipad apps, small sites. There's not much for them either.
  - bigiain 16y ago
    Another possible angle - as Thomas points out, researchers with "reputation" don't need this. But what about up and coming researchers? Where do they "earn their rep" in the current system? I could see this maybe taking off as a way for not-yet-reputable researchers to document their history/trackrecord, in much the same way as developers can use their github repos as documentation of their programming history. Maybe in a few years time we might see junior security researchers listing their Vularb account on their resumes...
    - iuguy 16y ago
      'Up and coming' Researchers generally improve their reputation by schmoozing journalists, doing conferences and so on. If for example, you didn't want to do through someone like ZDI you could just post the bug to full disclosure. If it's a big enough bug, then the media will come to you. Unfortunately in this industry 'rep' isn't earned, it's about who shouts the loudest, and it leads to some uncomfortable situations.