4 ms·

>if you are a legit white hat hacker There's no such thing in my book. There are, however, legitimate security researchers and consultants. If you are one of

>if you are a legit white hat hacker There's no such thing in my book. There are, however, legitimate security researchers and consultants. If you are one of these and have a service you want to provide, then get in touch with me like everyone else and make your pitch. Get my permission to provide your service, instead of just "providing" it then sending me what feels like extortion threats to buy it. I know that's not a popular opinion here, but IMO that idea is part of the problem, and exactly why the concept is so ripe for (and rife with) abuse.

noodlesUK 5y ago
I don’t know that I agree with looking at it that way. I find significant security vulnerabilities on sites from time to time (I have some modest security background but it isn’t my day job). I’m neither a security researcher or some kind of white hat hacker, just a concerned technically literate netizen. I have no interest in a bug bounty, I just want to see holes get patched. I’m not looking to provide some service, and I’m not actively probing for issues, I’m just letting people know that they’ve left their door open…
- unclebucknasty 5y ago
  I hear you. But, I was referring to the term "white hat" in the context of this thread. Maybe I should've better clarified that. So, the activity you're speaking of isn't what I had in mind. If you've discovered something that you freely report to help operators secure vulnerabilities, then that's one thing. But, this "business" of targeting companies uninvited, then requesting payment creates shady scenarios at best. Many times, you have no idea who these people are or affiliated with, and whether they will exploit or sell this info on the black market if you don't pay them. You also don't know if it's the beginning of a drip, whereby they just continuously target you for one-off "payment requests" on other issues. There's very much a predatory feel about it. If people want to offer a service for something this sensitive, important, and reliant on trust, then come through the front door and be transparent about what your service provides and how much it costs.

noodlesUK 5y ago

I don’t know that I agree with looking at it that way. I find significant security vulnerabilities on sites from time to time (I have some modest security background but it isn’t my day job). I’m neither a security researcher or some kind of white hat hacker, just a concerned technically literate netizen. I have no interest in a bug bounty, I just want to see holes get patched. I’m not looking to provide some service, and I’m not actively probing for issues, I’m just letting people know that they’ve left their door open…

unclebucknasty 5y ago
I hear you. But, I was referring to the term "white hat" in the context of this thread. Maybe I should've better clarified that. So, the activity you're speaking of isn't what I had in mind. If you've discovered something that you freely report to help operators secure vulnerabilities, then that's one thing. But, this "business" of targeting companies uninvited, then requesting payment creates shady scenarios at best. Many times, you have no idea who these people are or affiliated with, and whether they will exploit or sell this info on the black market if you don't pay them. You also don't know if it's the beginning of a drip, whereby they just continuously target you for one-off "payment requests" on other issues. There's very much a predatory feel about it. If people want to offer a service for something this sensitive, important, and reliant on trust, then come through the front door and be transparent about what your service provides and how much it costs.