3 ms·
The public launch of Cloudflare's bug bounty program
- eganist 5y agoThey only barely glossed over it, but I'm keen on finding out the lift that was required for reproducing their paid services in a sandbox the way they did for CumulusFire.
- fjfbsufhdvfy 5y agoWould that be significantly more complex than just setting up a random website, and making an account with the services enabled billed to themselves?
- eganist 5y agoYes, hence my question, because in many cases an environment like this would be sandboxed away so that a researcher doesn't accidentally break anything in production.
- fjfbsufhdvfy 5y ago"We’ve seen that immediately paying researchers led to a huge improvement in satisfaction compared to waiting weeks or months for a T-shirt." lol, what incredible insight.
- maxgashkov 5y agoBounty scale surprises me a lot. I always thought that the main incentive of any bug bounty program is to make it more attractive for any severe 0-day to not get onto black market and instead be compensated fairly by the company. Isn't $3,000 per Critical just a tiny bit too low for a service that proxies half the Internet?
- fjfbsufhdvfy 5y agoDon't worry, until a week ago people got a silly t-shirt for reporting a bug to Cloudflare! So clearly this is an improvement.