4 ms·
Unfortunately I feel like this is the new standard for security "researchers." Bug bounty programs and flashy brand name vulnerabilities have created this ecos
by admax88q 6y ago
Unfortunately I feel like this is the new standard for security "researchers."
Bug bounty programs and flashy brand name vulnerabilities have created this ecosystem where lots of security "researchers" publish long blog posts about so called "vulerabilities" they have discovered, hyping them up to be way more than they are. In hopes of getting bug bounties or hired as contractors I assume.
I had to unsubscribe from reddit's r/netsec and r/blackhat due to the number of borderline false posts like this.
There's like this intense pressure of people in security to network it seems. In the rare times I would post on netsec/blackhat to correct a misconception I'd get reached out to to connect on linkedin and whatnot.
Of course there is still some tremendous security researchers out there, like those at Google ProjectZero, but this industry seems to also attract a lot of borderline grifters.
- tptacek 6y agoThere's nothing at all new about marginal security researchers making mountains out of molehills; it's a time-honored tradition. But you're miscalibrated if your threshold for good researchers is P0. There's plenty of bounty randos doing tremendous work as well.
- admax88q 6y agoI guess, personally it just feels like there is an uptick in security "researchers" making mountains out of molehills, or more common mountains out of literally nothing, such as this "vulerability." This is akin to saying fakeroot gives you root capabilities, or claiming to get root by doing "export PS1='# '" I never said P0 is my threshold, I just used them as an example of good security researchers. I don't doubt there are plenty of randos doing good work. I'm just finding the signal to noise ratio is getting worse.