3 ms·

Ask HN: Responsible Discolure Without Compensation

5 points by jcuenod 5y ago

I recently discovered a security vulnerability on a SaaS that my university uses. They do not have a bug bounty program (I asked) and, reasonably enough, they want me to responsibly disclose it. I am not going to do anything malicious with the vulnerability and I will responsibly disclose it. However, I am in a humanities PhD with very low earning potential after I graduate and, right now, I have no real income as a student (apart from minimum wage on campus employment). Is it just me or is it unreasonable for a SaaS to expect responsible disclosure without compensating me?

ganoushoreilly 5y ago
It's not unreasonable as there was no contract or established program. You did the work without any defined outcome guaranteed. I would take this disclosure (depending on what it is and how it impacts) and use it to market yourself and further your industry credibility. If it's a big impact I think some sort of bounty is great, but you can use it as a pivot point to encourage them to build a program.
- jcuenod 5y ago
  Yes, there's no contract and I didn't start out expecting to come across a vulnerability so obviously there was no outcome expectation on my part. I think I'm feeling frustrated that industry credibility is not meaningful to me because this is not my industry and the expectation of pro bono responsible disclosure means that they take advantage of my expertise when (1) I never offered it and (2) they pay developers to do this kind of work all the time. I think you're helping me get at an underlying question I have: is it fair to say, "if you're running a SaaS, you should have a bug bounty program?"
CaptainJustin 5y ago
From their perspective it might feel a bit like a hostage situation: "I found a way into your house. How much you going to pay me tell you how?" From your perspective I would imagine that exploring the vulnerability, packaging and capturing the steps-to-reproduce are all work. Work should be paid for. In summary, I don't think they can make demands of your time and effort by requiring you to package and share. But don't let it sound like a you have anything they have a right to or that you're holding anything hostage.
- jcuenod 5y ago
  Sure, I get the hostage situation perspective so I am obviously not framing my interaction in any sense as a threat or as though I have leverage. I think my question is whether it's reasonable for them to expect me to hand over information that amounts to work and to do so pro bono.
stevenalowe 5y ago
Offer a write up/video (concrete deliverable) for a fixed price to compensate you for your time and expertise with a money back guarantee if it can’t be replicated and sign an NDA to not disclose to anyone else for several years. Ask for the $ you want and accept anything reasonable. Sign an NDA first to establish trust - make it clear you have no ill intentions

5 points by jcuenod 5y ago

ganoushoreilly 5y ago

It's not unreasonable as there was no contract or established program. You did the work without any defined outcome guaranteed. I would take this disclosure (depending on what it is and how it impacts) and use it to market yourself and further your industry credibility. If it's a big impact I think some sort of bounty is great, but you can use it as a pivot point to encourage them to build a program.

jcuenod 5y ago
Yes, there's no contract and I didn't start out expecting to come across a vulnerability so obviously there was no outcome expectation on my part. I think I'm feeling frustrated that industry credibility is not meaningful to me because this is not my industry and the expectation of pro bono responsible disclosure means that they take advantage of my expertise when (1) I never offered it and (2) they pay developers to do this kind of work all the time. I think you're helping me get at an underlying question I have: is it fair to say, "if you're running a SaaS, you should have a bug bounty program?"

CaptainJustin 5y ago

From their perspective it might feel a bit like a hostage situation: "I found a way into your house. How much you going to pay me tell you how?" From your perspective I would imagine that exploring the vulnerability, packaging and capturing the steps-to-reproduce are all work. Work should be paid for. In summary, I don't think they can make demands of your time and effort by requiring you to package and share. But don't let it sound like a you have anything they have a right to or that you're holding anything hostage.

jcuenod 5y ago
Sure, I get the hostage situation perspective so I am obviously not framing my interaction in any sense as a threat or as though I have leverage. I think my question is whether it's reasonable for them to expect me to hand over information that amounts to work and to do so pro bono.

stevenalowe 5y ago

Offer a write up/video (concrete deliverable) for a fixed price to compensate you for your time and expertise with a money back guarantee if it can’t be replicated and sign an NDA to not disclose to anyone else for several years. Ask for the $ you want and accept anything reasonable. Sign an NDA first to establish trust - make it clear you have no ill intentions