3 ms·
People here dislike HackerOne, but afaiu it solves this exact problem. It's the first line of ‘support’ for security reporters. The fact that the industry curr
by aasasd 6y ago
People here dislike HackerOne, but afaiu it solves this exact problem. It's the first line of ‘support’ for security reporters.
The fact that the industry currently needs this kind of solution is absurdly comedic. Basically, it would make actual sense to require people to pay ten bucks when posting a report—if they think the report is reasonable and that they would get paid for it.
- tptacek 6y agoIt’s a good platform, but it really doesn’t solve the time-sink problem, even if you pay for triage services. Triage can knock down well-known patterns of bogus stuff, but so can you; the real problem is the truly wacky stuff people come up with.
- deleted 6y ago[deleted]
- fractionalhare 6y agoI can see and read the JavaScript source code if I intercept the requests! Please pay me $100.
- marco_craveiro 6y agoHi @fractionalhare, apologies for the spam but I am trying to read a post you made a few months ago on implementing Exp [1] but it seems the site is down. Is there a different source perhaps? Many thanks for your time. [1] https://www.pseudorandom.com/implementing-exp https://www.pseudorandom.com/implementing-exp
- selfhoster11 6y agoI'd never enter in a paid interaction without some sort of escrow that will make sure I'm not screwed over for the crime of being a good citizen. The victim could just keep the cost of the report without ever refunding. Innocent people will keep getting caught by this even long after the company acquires a reputation for never providing refunds.
- aasasd 6y agoSince the escrow sees your report, it sounds like HackerOne. HO will just create paid tiers where for a smallish subscription price, people actually take your reports seriously.
- 67868018 6y agoSmart contracts on Ethereum blockchain... force them to set a date to pay you and go public. They can't back out. Going to need a lot of work in the next few years to make something like this viable, but ETH could make it possible
- aasasd 6y agoAre you saying that Eth can somehow withhold info until a future time when it automatically becomes public? How would that work?
- 67868018 6y agoEthereum has a Turing complete programming language inside
- aasasd 6y agoYeah so? Think about it. How do you make a blob of data unreadable by people on Thursday but readable on Friday? You can't do it without a trusted third-party. If Eth has a solution for this, it would mean it basically solves trust in general, which is a persistent pain in all of infosec.