3 ms·

Practically, HackerOne is already in the business of validating vulnerability reports, and they did so here. The real problem is that HackerOne takes a commissi

Practically, HackerOne is already in the business of validating vulnerability reports, and they did so here. The real problem is that HackerOne takes a commission on vulnerability reports but does not protect the researcher if the program doesn't pay for the validated report. Other platforms like Bugcrowd do protect you (which is probably sufficient for the problem you describe), but HackerOne strangely does not. There's already a trusted intermediary, you don't really need to hide the report from the company -- the intermediary just needs to provide protections to both sides.

Shank 4y ago
disclaimer/context: I'm a HackerOne customer (I manage a program, and heavily compared Bugcrowd to HackerOne prior to purchase). > Practically, HackerOne is already in the business of validating vulnerability reports, and they did so here. This is true of some programs, but not all. Only for programs that HackerOne manages and triages for is this the case. Companies can and do refuse the triage service. The triage service, and H1 staff are incredibly devoted to the hacker side of things. H1 staff routinely advises when we should pay more, when we should award bounties on borderline issues, and offers their mediation process if a hacker disagrees with our judgement. They push us (and I assume other companies) to increase the scope of your program, to increase bounty payouts, and to decrease complexity with complying with program rules. > The real problem is that HackerOne takes a commission on vulnerability reports but does not protect the researcher if the program doesn't pay for the validated report. I manage a HackerOne program, and at least on our contract, this isn't as straightforward as you might expect. We pay for HackerOne's services with a tiered billing structure based on how many bounties we pay out. If we pay out $1500 we pay out $1500 flat, nothing skimmed off the top. If we pay out more than $x, we have to pay for an additional consumption tier irrespective of whether or not we pay out bounties up to the max on that tier. > Other platforms like Bugcrowd do protect you (which is probably sufficient for the problem you describe), but HackerOne strangely does not. For the most part, Bugcrowd has its own set of problems, which is offputting to a lot of people, including my team. Specifically, Bugcrowd’s Vulnerability Rating Taxonomy [0] includes many things, particularly in the P4/P5 categories, that are extremely noisy. In both cases, both companies don't pay out on dupe reports, for example. [0]: https://bugcrowd.com/vulnerability-rating-taxonomy https://bugcrowd.com/vulnerability-rating-taxonomy

Shank 4y ago

disclaimer/context: I'm a HackerOne customer (I manage a program, and heavily compared Bugcrowd to HackerOne prior to purchase). > Practically, HackerOne is already in the business of validating vulnerability reports, and they did so here. This is true of some programs, but not all. Only for programs that HackerOne manages and triages for is this the case. Companies can and do refuse the triage service. The triage service, and H1 staff are incredibly devoted to the hacker side of things. H1 staff routinely advises when we should pay more, when we should award bounties on borderline issues, and offers their mediation process if a hacker disagrees with our judgement. They push us (and I assume other companies) to increase the scope of your program, to increase bounty payouts, and to decrease complexity with complying with program rules. > The real problem is that HackerOne takes a commission on vulnerability reports but does not protect the researcher if the program doesn't pay for the validated report. I manage a HackerOne program, and at least on our contract, this isn't as straightforward as you might expect. We pay for HackerOne's services with a tiered billing structure based on how many bounties we pay out. If we pay out $1500 we pay out $1500 flat, nothing skimmed off the top. If we pay out more than $x, we have to pay for an additional consumption tier irrespective of whether or not we pay out bounties up to the max on that tier. > Other platforms like Bugcrowd do protect you (which is probably sufficient for the problem you describe), but HackerOne strangely does not. For the most part, Bugcrowd has its own set of problems, which is offputting to a lot of people, including my team. Specifically, Bugcrowd’s Vulnerability Rating Taxonomy [0] includes many things, particularly in the P4/P5 categories, that are extremely noisy. In both cases, both companies don't pay out on dupe reports, for example. [0]: https://bugcrowd.com/vulnerability-rating-taxonomy https://bugcrowd.com/vulnerability-rating-taxonomy