3 ms·

They offer $2000 bounties max. It's no wonder the researcher didn't bother disclosing to them (assuming this is even true) and instead disclosed to downstream c

They offer $2000 bounties max. It's no wonder the researcher didn't bother disclosing to them (assuming this is even true) and instead disclosed to downstream companies, that is not a reasonable payment commensurate to the effort and criticality of the finding. Folks are not obligated to donate their time.

tommiegannert 5y ago
>> While Nguyen released the public exploit for this bug, he is not the one who discovered the vulnerability. >> >> The person who did is Wunderfund CTO and founder Emil Lerner, who found the bug last year and used it to obtain bug bounties from companies like Airbnb, Dropbox, and Yandex. > > Folks are not obligated to donate their time. When it comes to open-source, I think this is a weak argument. While I consider your statement true, it's a "glass half-empty" way of looking at working together to build useful software. Releasing an exploit before a fix is applied also negates work other people have put into the project. It's surprising to me that neither Lerner, nor any of the downstream companies, upstreamed the fix in a year's time. If true that none tried, as you point out. > Details about the vulnerability leaked into the public domain last month after Lerner held a talk at the ZeroNight X security conference about the current attack vector posed by server-side image conversion tools and used the Ghostscript zero-day as an example.
pabs3 5y ago
While I can understand trying to get larger payouts and I still think what the researcher did is unethical, I'm even more disappointed with the security process of those downstream companies, they have to be pretty incompetent to not immediately burn the vulnerability by reporting it upstream. Unless of course they were planning on exploiting their competitors using it, which is even worse. Probably more likely is employees are forbidden from contributing back to open source, which means they each have incompetent legal departments.
- jessaustin 5y ago
  Yes, it's disproportionate to criticize individual researchers for failing to do what well-funded companies also failed to do.

tommiegannert 5y ago

>> While Nguyen released the public exploit for this bug, he is not the one who discovered the vulnerability. >> >> The person who did is Wunderfund CTO and founder Emil Lerner, who found the bug last year and used it to obtain bug bounties from companies like Airbnb, Dropbox, and Yandex. > > Folks are not obligated to donate their time. When it comes to open-source, I think this is a weak argument. While I consider your statement true, it's a "glass half-empty" way of looking at working together to build useful software. Releasing an exploit before a fix is applied also negates work other people have put into the project. It's surprising to me that neither Lerner, nor any of the downstream companies, upstreamed the fix in a year's time. If true that none tried, as you point out. > Details about the vulnerability leaked into the public domain last month after Lerner held a talk at the ZeroNight X security conference about the current attack vector posed by server-side image conversion tools and used the Ghostscript zero-day as an example.

pabs3 5y ago

While I can understand trying to get larger payouts and I still think what the researcher did is unethical, I'm even more disappointed with the security process of those downstream companies, they have to be pretty incompetent to not immediately burn the vulnerability by reporting it upstream. Unless of course they were planning on exploiting their competitors using it, which is even worse. Probably more likely is employees are forbidden from contributing back to open source, which means they each have incompetent legal departments.

jessaustin 5y ago
Yes, it's disproportionate to criticize individual researchers for failing to do what well-funded companies also failed to do.