3 ms·
> you can hire there lies the difference, duh.
by avereveard 6y ago
> you can hire
there lies the difference, duh.
- lrvick 6y agoAnd what about the hundreds of NPM dependencies in VS Code no one reviews? Or the the thousands of brew packages that are blindly merged unsigned by 800 people with access? Who pays to give a white hat as much freedom to find supply chain attack vectors here? Who gets consent from every random student whose code, if compromised, would compromise every major company? We have created a massive mess, and I don't know that we will be able to hire enough researchers to fix it. We are going to need unpaid volunteers, and a lot of them.
- avereveard 6y agoholy moving the goalpost batman, slow down. > We are going to need unpaid volunteers, and a lot of them. that's absolutely orthogonal to the question at hand, it's not a matter of paid or unpaid, neither being volunteer or not: it's a matter of consent. if you don't sought consent beforehand either via a contract relationship or a sponsored bug hunt program or the likes, you're a racketeer, not a white hat, and you should (and will) be treated as such.