3 ms·

>$1750 for that?! Security researchers need to organize! https://hackerone.com/slack?type=team https://hackerone.com/slack?type=team It says right on the tin

by jcims 6y ago

>$1750 for that?! Security researchers need to organize! https://hackerone.com/slack?type=team https://hackerone.com/slack?type=team It says right on the tin what the payout is going to be. If you don't like the terms of the program, don't participate. It's not really that difficult a concept.

slimsag 6y ago
Had the researchers (unethically) published it as a zero-day vulnerability in e.g. a blog post stating "the slack payout wasn't enough for us to care" - what would've been their legal risks? I assume that would be _one_ way to get companies to care more about rewarding people who spend substantial amounts of time researching their security
- WrtCdEvrydy 6y ago
  A friend of mine swears that you can be sued for 'business damages' over improper disclosure. Sadly, the US is a non-permissive environment so I tend to believe it.
  - tptacek 6y ago
    I think that friend of yours is almost certainly wrong, and for decades now there have been notable researchers who disclose publicly and immediately.
  - IncRnd 6y ago
    In many cases that is correct, but in practice this will never happen.
- jcims 6y ago
  Finding and disclosing vulnerabilities predates bug bounties by a long stretch. Bug bounties are simply an incentive for people to follow a scope and disclosure policy through a legal safe harbor and small financial incentive, but they aren't always effective at that. Folks that operate outside of the bounty program don't have that safe harbor and are likely exposed to the full force of whatever domestic 'hacking' laws exist on the books. In the US this has resulted in jail time and fines. If someone doesn't like the terms of a particular bug bounty program, I would ask why they are doing research against that company to begin with. That's like someone really wanting kids dating a person that doesn't want kids and hoping they will change their mind after they see how awesome it will be. Almost without exception, if you read the comments from the individuals reporting the bugs, they will actually defend the status quo (as is the case here if you dig around). It's mostly just loud people in the vicinity of this trying to drive up the market. Of course in my example I could try to incentivize said partner to have children by all sorts of unethical means, and there are certainly ways for researchers to try to incentivize corporations to increase bounty scope or payout by unethical means. This is generally considered 'extortion'. Lastly I think it's also important to point out that legality has nothing to do with ethics, and I certainly believe there are cases where disclosure is warranted outside of any established paradigm of 'responsible disclosure' or bounty program.
gorgoiler 6y ago
I mean I certainly aren’t smart enough to complete a bounty half as big a deal as this, and I could certainly use a month’s rent in cash. My point was about the wider security economy. It feels like Slack are low balling for work which they have a moral duty (er, moral in the sense that spectres haunt Europe) to pay something more like a living / minimum wage for hackers.
stevenjohns 6y ago
Your link seems to indicate that this falls into the "$5000 and up" category.
- jcims 6y ago
  Sorry, sent the wrong link - https://hackerone.com/slack/bounty_table_versions?type=team&change=2020-08-07T21%3A17%3A54.807Z https://hackerone.com/slack/bounty_table_versions?type=team&...

by jcims 6y ago

slimsag 6y ago

Had the researchers (unethically) published it as a zero-day vulnerability in e.g. a blog post stating "the slack payout wasn't enough for us to care" - what would've been their legal risks? I assume that would be _one_ way to get companies to care more about rewarding people who spend substantial amounts of time researching their security

WrtCdEvrydy 6y ago
A friend of mine swears that you can be sued for 'business damages' over improper disclosure. Sadly, the US is a non-permissive environment so I tend to believe it.
- tptacek 6y ago
  I think that friend of yours is almost certainly wrong, and for decades now there have been notable researchers who disclose publicly and immediately.
- IncRnd 6y ago
  In many cases that is correct, but in practice this will never happen.
jcims 6y ago
Finding and disclosing vulnerabilities predates bug bounties by a long stretch. Bug bounties are simply an incentive for people to follow a scope and disclosure policy through a legal safe harbor and small financial incentive, but they aren't always effective at that. Folks that operate outside of the bounty program don't have that safe harbor and are likely exposed to the full force of whatever domestic 'hacking' laws exist on the books. In the US this has resulted in jail time and fines. If someone doesn't like the terms of a particular bug bounty program, I would ask why they are doing research against that company to begin with. That's like someone really wanting kids dating a person that doesn't want kids and hoping they will change their mind after they see how awesome it will be. Almost without exception, if you read the comments from the individuals reporting the bugs, they will actually defend the status quo (as is the case here if you dig around). It's mostly just loud people in the vicinity of this trying to drive up the market. Of course in my example I could try to incentivize said partner to have children by all sorts of unethical means, and there are certainly ways for researchers to try to incentivize corporations to increase bounty scope or payout by unethical means. This is generally considered 'extortion'. Lastly I think it's also important to point out that legality has nothing to do with ethics, and I certainly believe there are cases where disclosure is warranted outside of any established paradigm of 'responsible disclosure' or bounty program.

gorgoiler 6y ago

I mean I certainly aren’t smart enough to complete a bounty half as big a deal as this, and I could certainly use a month’s rent in cash. My point was about the wider security economy. It feels like Slack are low balling for work which they have a moral duty (er, moral in the sense that spectres haunt Europe) to pay something more like a living / minimum wage for hackers.

stevenjohns 6y ago

Your link seems to indicate that this falls into the "$5000 and up" category.

jcims 6y ago
Sorry, sent the wrong link - https://hackerone.com/slack/bounty_table_versions?type=team&change=2020-08-07T21%3A17%3A54.807Z https://hackerone.com/slack/bounty_table_versions?type=team&...