4 ms·
This is a key issue I see with bugbounty programs. They tend to react with "either you can show us that this is a real danger or we'll ignore it". It seems pr
by hannob 6y ago
This is a key issue I see with bugbounty programs.
They tend to react with "either you can show us that this is a real danger or we'll ignore it".
It seems pretty clear that this bug shows something is terribly wrong and probably dangerous. But the reporter might have limits in analyzing the bug, while the company could easily figure out what's going on and fix it.
- dane-pgp 6y ago> They tend to react with "either you can show us that this is a real danger or we'll ignore it". This is a bit of a Catch-22 situation, as I get the feeling that proving the danger would often involve doing things that bounty programs specifically forbid, such as "Moving beyond “proof of concept” repro steps"[0]. That may be part of the reason why Microsoft got away with such a stingy response to the RCE vulnerability found in Teams by Oskars Vegeris.[1] [0] https://www.microsoft.com/en-us/msrc/bounty-online-services?rtc=1 https://www.microsoft.com/en-us/msrc/bounty-online-services?... [1] https://github.com/oskarsve/ms-teams-rce/blob/main/README.md https://github.com/oskarsve/ms-teams-rce/blob/main/README.md
- dkdk8283 6y agoI fault Agile for this and not big bounty implementations. Getting points to address a big because a random internet source pointed it out to us is difficult. There is likely a long backlog of bugs already.