3 ms·

Indeed, it means companies get a loophole for not paying for your bug bounty research because it wasn't done in "g00d f@ith" and is "3x70r710n": "for the purpo

by 1970-01-01 4y ago

Indeed, it means companies get a loophole for not paying for your bug bounty research because it wasn't done in "g00d f@ith" and is "3x70r710n": "for the purpose of discovering security holes in devices, machines, or services in order to extort the owners of such devices, machines, or services—might be called “research,” but is not in good faith."

burnished 4y ago
Are you imagining that a security researcher trying to get money from a bug bounty program would be considered extortion? Unless said hypothetical researcher says "pay me or I sell the exploit to the highest bidder", I don't believe the situation you are worried about could exist.
bragr 4y ago
Companies' bug bounty programs are bound by their terms of service, not by this policy or the CFAA so I'm not sure what you are complaining about. Additionally companies are under no obligation to pay anyone for security research they did on their own (which is not to say that's a good policy) but they don't have to, and attempting to extort them into paying was crime before and it's still a crime. The main people I would say this impacts is the people doing security research as a pure research pursuit, a hobby, otherwise as journalism or in the public interest.
- 1970-01-01 4y ago
  Having a bug bounty system designed to maximize the work put into testing a system with minimum payout is my chief complaint. The new "policy" does nothing to help that.
  - KerrAvon 4y ago
    No one is being compelled to do the work. Are you really saying you want the government involved in setting rates?
    - 1970-01-01 4y ago
      Rates would be going too far. I would like to see an exception for non-payment for services rendered.
      - bragr 4y ago
        You seem to confusing criminal federal law concerning unauthorized computer access with a civil federal law regulating the trade of software vulnerabilities, which is what you'd need to solve the "problem" you are complaining about.
        tptacek 4y ago
        Which civil federal laws are those?
tptacek 4y ago
Nobody needs a loophole to not pay for DMARC configuration reports and logout CSRFs; they can just not pay.

burnished 4y ago

Are you imagining that a security researcher trying to get money from a bug bounty program would be considered extortion? Unless said hypothetical researcher says "pay me or I sell the exploit to the highest bidder", I don't believe the situation you are worried about could exist.

bragr 4y ago

Companies' bug bounty programs are bound by their terms of service, not by this policy or the CFAA so I'm not sure what you are complaining about. Additionally companies are under no obligation to pay anyone for security research they did on their own (which is not to say that's a good policy) but they don't have to, and attempting to extort them into paying was crime before and it's still a crime. The main people I would say this impacts is the people doing security research as a pure research pursuit, a hobby, otherwise as journalism or in the public interest.

1970-01-01 4y ago
Having a bug bounty system designed to maximize the work put into testing a system with minimum payout is my chief complaint. The new "policy" does nothing to help that.
- KerrAvon 4y ago
  No one is being compelled to do the work. Are you really saying you want the government involved in setting rates?
  - 1970-01-01 4y ago
    Rates would be going too far. I would like to see an exception for non-payment for services rendered.
    - bragr 4y ago
      You seem to confusing criminal federal law concerning unauthorized computer access with a civil federal law regulating the trade of software vulnerabilities, which is what you'd need to solve the "problem" you are complaining about.
      - tptacek 4y ago
        Which civil federal laws are those?

tptacek 4y ago

Nobody needs a loophole to not pay for DMARC configuration reports and logout CSRFs; they can just not pay.