4 ms·

I had much the same reaction when reading this, as someone who corresponded with one of these individuals this week. The institution of bug bounties is structu

I had much the same reaction when reading this, as someone who corresponded with one of these individuals this week. The institution of bug bounties is structurally reliant on a huge wage gap between countries. “Picking the wrong country to be born in” is not a moral fault. Yes, many of the people engaged in bounty farming at scale are low-skilled relative to the average HN reader, but they are probably not low skilled relative to the average HN reader at the lowest skilled portion of your own career, and when you were being paid for your labor during that portion, you earned a month’s wages for this guy in ~hours of work. It is also true that they don’t conform to our class norms in communications styles. That’s also something I’d suggest moderating one’s emotional response to out of noblesse oblige.

patio11 5y ago
If folks are curious, my initial email back was: “I’m responding to this out of abundance of charity, but given literally no identifying information in the email I think there is a high probability I am speaking to a script rather than a human. What do you want to tell me about what application specifically?” They responded that they were a human and asked whether there was a bug bounty. I sent them a one word No. They replied “Thanks” and that was the end of it. I wrote the first email on the thought that it might have been an early career security researcher possibly poorly calibrated on how to reach a security contact, and if I write it in the future, I will probably revise the “human” language as it doesn’t travel as well as I intended it to. Perhaps: “It would be more effective in the future to include details about the report or at least about which application you are reporting about to route emails like this effectively.” followed by the query.

patio11 5y ago

If folks are curious, my initial email back was: “I’m responding to this out of abundance of charity, but given literally no identifying information in the email I think there is a high probability I am speaking to a script rather than a human. What do you want to tell me about what application specifically?” They responded that they were a human and asked whether there was a bug bounty. I sent them a one word No. They replied “Thanks” and that was the end of it. I wrote the first email on the thought that it might have been an early career security researcher possibly poorly calibrated on how to reach a security contact, and if I write it in the future, I will probably revise the “human” language as it doesn’t travel as well as I intended it to. Perhaps: “It would be more effective in the future to include details about the report or at least about which application you are reporting about to route emails like this effectively.” followed by the query.