5 ms·

I think it does. And I think the argument that it is useful for other to learn about that person and the general approach they use and avoid being scammed a pre

by soneca 5y ago

I think it does. And I think the argument that it is useful for other to learn about that person and the general approach they use and avoid being scammed a pretty persuasive argument. The situation I imagine is someone outside of the parking lot showing up to me and telling me there is something wrong with my car, but they will only disclose it to me if I pay them $50. Then I happen to be an expert car mechanic and I know my car pretty well and I know whatever they tell me is irrelevant and definitely not a security concern. I think it is pretty justified to alert other car owners of that same parking lot that ”that guy in the blue shirt telling you you have a problem with your car is just a scammer, don’t pay him”. That’s nothing like complaining about a begger offering to wash your window. It is useful even for real white hat hackers sharing actual problems.

hitekker 5y ago
Agreed. Troy is shaming a serial scammer. We don't know anything else about the scammer's background other than that they calls themselves "Muhammed" Moreover, the presumption that an Islamic name means they’re underprivileged or foreign-born is condescending, maybe even racist. My rich South Asian friends in high school had similar names, similar hacking proclivities and very much the same poorly English in their written correspondences.
Ajedi32 5y ago
There's a significant difference between low quality reports and an actual scam. Refusing to disclose without payment is a big red flag in my opinion. Those types of reports are extortion at the very least, if not necessarily outright scams. Low quality reports that include a POC are, on the other hand, neither extortion nor scams. They may be problematic for other reasons (lowering the signal-to-noise ratio), but they don't fall into the same category as the aforementioned "no disclosure without payment" reports and should not be treated the same way in my opinion.
tptacek 5y ago
I want to say this gingerly because who knows if I'm right, but here goes: I think the only way to come to this kind of conclusion is if you're hearing about the SPF-record beg-bounty phenomenon for the first time in this article. Because we get these all the time. There can't be any benefit to singling any one of them out. Further: this isn't a 419 scam. You're not soliciting wooden keyboards from people trying to ransack your bank account. These are just pentesters who are not (perhaps yet?) good at their job. The reports you get from them are dumb, but they're not usually wrong; they're just issues that nobody cares about. You can write a post about the beg bounty fraud without using cruelty to stimulate the nucleus accumbens of a huge number of people. But it's harder to do it, because the underlying observation ("oh, there's a lot of bogus scanner-fodder bounty posts") is banal. Here, Troy wanted to light us all up. But he didn't want to work to do it. So he recast some hapless bounty dork as a scammer and built a whole post around administering justice to them. Gross. There are a lot of disadvantaged people overseas and they're increasingly connected. They're fundamentally no less capable than we are. I look forward to their eventual overthrow of infosec.
- DoreenMichele 5y ago
  There are a lot of disadvantaged people all over the world at the moment. Thank you for this comment. This article and some of the comments here have made me enormously uncomfortable. There are serious double standards where if privileged people do it, it's wise/clever/smart. If poor people do essentially the same thing, they are morally depraved abusers for wanting money. The phrase "fake it til you make it" comes to mind here. For privileged people, that approach is celebrated and encouraged. Here, it's being maligned in a way that strikes me as classism.
- soneca 5y ago
  > ”is if you're hearing about the SPF-record beg-bounty phenomenon for the first time in this article” I don’t know what “gingerly” means, but you are right in this assumption. I only own small side projects sites, but the article felt like a useful warning to me in case I receive such a message some day. I am more inclined to agree with you than before your reply, your point of view makes sense. I would still call the article more “helpful” than “gross” though.
  - tptacek 5y ago
    "There's lots of annoying, unsolicited, bad bug bounty submissions" is a useful thing to point out, even if it's probably too boring for Troy's core audience to stand on its own. The phenomenon he's describing is real. Honestly: if he hadn't brought up that he was called out for this and tried to rebut it, I wouldn't have thought to write about it. But he did, and, like I said, his argument is pretty weak.

by soneca 5y ago

hitekker 5y ago

Agreed. Troy is shaming a serial scammer. We don't know anything else about the scammer's background other than that they calls themselves "Muhammed" Moreover, the presumption that an Islamic name means they’re underprivileged or foreign-born is condescending, maybe even racist. My rich South Asian friends in high school had similar names, similar hacking proclivities and very much the same poorly English in their written correspondences.

Ajedi32 5y ago

There's a significant difference between low quality reports and an actual scam. Refusing to disclose without payment is a big red flag in my opinion. Those types of reports are extortion at the very least, if not necessarily outright scams. Low quality reports that include a POC are, on the other hand, neither extortion nor scams. They may be problematic for other reasons (lowering the signal-to-noise ratio), but they don't fall into the same category as the aforementioned "no disclosure without payment" reports and should not be treated the same way in my opinion.

tptacek 5y ago

I want to say this gingerly because who knows if I'm right, but here goes: I think the only way to come to this kind of conclusion is if you're hearing about the SPF-record beg-bounty phenomenon for the first time in this article. Because we get these all the time. There can't be any benefit to singling any one of them out. Further: this isn't a 419 scam. You're not soliciting wooden keyboards from people trying to ransack your bank account. These are just pentesters who are not (perhaps yet?) good at their job. The reports you get from them are dumb, but they're not usually wrong; they're just issues that nobody cares about. You can write a post about the beg bounty fraud without using cruelty to stimulate the nucleus accumbens of a huge number of people. But it's harder to do it, because the underlying observation ("oh, there's a lot of bogus scanner-fodder bounty posts") is banal. Here, Troy wanted to light us all up. But he didn't want to work to do it. So he recast some hapless bounty dork as a scammer and built a whole post around administering justice to them. Gross. There are a lot of disadvantaged people overseas and they're increasingly connected. They're fundamentally no less capable than we are. I look forward to their eventual overthrow of infosec.

DoreenMichele 5y ago
There are a lot of disadvantaged people all over the world at the moment. Thank you for this comment. This article and some of the comments here have made me enormously uncomfortable. There are serious double standards where if privileged people do it, it's wise/clever/smart. If poor people do essentially the same thing, they are morally depraved abusers for wanting money. The phrase "fake it til you make it" comes to mind here. For privileged people, that approach is celebrated and encouraged. Here, it's being maligned in a way that strikes me as classism.
soneca 5y ago
> ”is if you're hearing about the SPF-record beg-bounty phenomenon for the first time in this article” I don’t know what “gingerly” means, but you are right in this assumption. I only own small side projects sites, but the article felt like a useful warning to me in case I receive such a message some day. I am more inclined to agree with you than before your reply, your point of view makes sense. I would still call the article more “helpful” than “gross” though.
- tptacek 5y ago
  "There's lots of annoying, unsolicited, bad bug bounty submissions" is a useful thing to point out, even if it's probably too boring for Troy's core audience to stand on its own. The phenomenon he's describing is real. Honestly: if he hadn't brought up that he was called out for this and tried to rebut it, I wouldn't have thought to write about it. But he did, and, like I said, his argument is pretty weak.