4 ms·

> There's security research and there's bug prospecting. If the end result of your work isn't a whitepaper or something similar from which others can learn, th

> There's security research and there's bug prospecting. If the end result of your work isn't a whitepaper or something similar from which others can learn, then you can call your work "security research". Bug bounty programs are mainly targeted at bug prospectors. > Both have streaks of narcissists and showboaters but the latter seems to be thick with them. Thank god for that. Blog posts like the one this thread is about are really valuable to those of us interested in the work of others.

jcims 6y ago
>Thank god for that. Blog posts like the one this thread is about are really valuable to those of us interested in the work of others. I can see how what I said could be interpreted as 'folks that blog about their work are narcissists'. That wasn't my intent. The headline is a bit clickbaity but the explanation is a good walkthrough. This isn't the far end of the spectrum that I had in mind. Watching twitter or working for a bug bounty program is a better way to get exposed to that set.
- thaumasiotes 6y ago
  I worked for several bug bounty programs; showboating didn't really seem to be a major issue.
  - deleted 6y ago
    [deleted]
  - jcims 6y ago
    Maybe things have gotten better. I worked for one a while back and came away with a notion of the two distinct communities I described. I try to focus mostly on the positive side, which was the majority and had some amazing and inspiring folks, but the other side had some really irritating people with wholly unprofessional conduct. Bug Bounty King really spoke to me haha
    - thaumasiotes 6y ago
      > some really irritating people with wholly unprofessional conduct. Yeah, they're very common. But, in my experience, showboating wasn't.
tptacek 6y ago
Respectfully, I feel like you all are making up a taxonomy that feels right to you, but that is definitely not accepted by the vuln research field. Further: this idea that "research" is something we have to valorize, and that you have to meet a public interest threshold to be worthy of it, is itself a standard to which the real world does not adhere. There are lots of different kinds of "research" out there; there are researchers who look for cures for cancer, and there are "researchers" who maintain stacks of index cards full of competitive market intelligence gleaned from press releases. The term "researcher" is about the kind of work you do, not the use to which it's put. Maybe I'm just old and not keeping up with what the kids these days are saying, but I don't think "bug prospector" is a thing.
- jcims 6y ago
  No you're right, bug prospector was made up on the spot. I'm old too and I confused the conversation by hauling out my rusty trusty grinding axe about some miscreants I encountered along the way. In general though I do think we diffuse the term 'research' a bit in this case by applying it to a very broad spectrum of actions and motivations. As a result I think we lose some of the nuances of incentive that emerge at opposite ends of that spectrum. I mean we do call them 'bug bounties' afterall and we don't call Duane Chapman 'Dog the Fugitive Reseacher'. :)
- kortilla 6y ago
  The academic difference is quite distinct and is well understood in the research community there. Impressive vulnerabilities that could take down all of Google wouldn’t be accepted into any security research conferences/journals if the bug didn’t involve a new class of vulnerability or discovery method. The term “bug prospector” might not be widely accepted, but people just looking for well understood bugs in production systems aren’t doing “research” in the academic sense anymore than a person at McDonald’s “researching” the menu to decide what to eat.
  - tptacek 6y ago
    Vulnerability researchers aren't generally academic researchers. "Vulnerability research" is a term of art.

jcims 6y ago

>Thank god for that. Blog posts like the one this thread is about are really valuable to those of us interested in the work of others. I can see how what I said could be interpreted as 'folks that blog about their work are narcissists'. That wasn't my intent. The headline is a bit clickbaity but the explanation is a good walkthrough. This isn't the far end of the spectrum that I had in mind. Watching twitter or working for a bug bounty program is a better way to get exposed to that set.

thaumasiotes 6y ago
I worked for several bug bounty programs; showboating didn't really seem to be a major issue.
- deleted 6y ago
  [deleted]
- jcims 6y ago
  Maybe things have gotten better. I worked for one a while back and came away with a notion of the two distinct communities I described. I try to focus mostly on the positive side, which was the majority and had some amazing and inspiring folks, but the other side had some really irritating people with wholly unprofessional conduct. Bug Bounty King really spoke to me haha
  - thaumasiotes 6y ago
    > some really irritating people with wholly unprofessional conduct. Yeah, they're very common. But, in my experience, showboating wasn't.

tptacek 6y ago

Respectfully, I feel like you all are making up a taxonomy that feels right to you, but that is definitely not accepted by the vuln research field. Further: this idea that "research" is something we have to valorize, and that you have to meet a public interest threshold to be worthy of it, is itself a standard to which the real world does not adhere. There are lots of different kinds of "research" out there; there are researchers who look for cures for cancer, and there are "researchers" who maintain stacks of index cards full of competitive market intelligence gleaned from press releases. The term "researcher" is about the kind of work you do, not the use to which it's put. Maybe I'm just old and not keeping up with what the kids these days are saying, but I don't think "bug prospector" is a thing.

jcims 6y ago
No you're right, bug prospector was made up on the spot. I'm old too and I confused the conversation by hauling out my rusty trusty grinding axe about some miscreants I encountered along the way. In general though I do think we diffuse the term 'research' a bit in this case by applying it to a very broad spectrum of actions and motivations. As a result I think we lose some of the nuances of incentive that emerge at opposite ends of that spectrum. I mean we do call them 'bug bounties' afterall and we don't call Duane Chapman 'Dog the Fugitive Reseacher'. :)
kortilla 6y ago
The academic difference is quite distinct and is well understood in the research community there. Impressive vulnerabilities that could take down all of Google wouldn’t be accepted into any security research conferences/journals if the bug didn’t involve a new class of vulnerability or discovery method. The term “bug prospector” might not be widely accepted, but people just looking for well understood bugs in production systems aren’t doing “research” in the academic sense anymore than a person at McDonald’s “researching” the menu to decide what to eat.
- tptacek 6y ago
  Vulnerability researchers aren't generally academic researchers. "Vulnerability research" is a term of art.