8 ms·

I wish closing things as "this is a duplicate" essentially required disclosure of the original (dupe) report. It may well be that it's a dupe, or it may be som

by eterm 4y ago

I wish closing things as "this is a duplicate" essentially required disclosure of the original (dupe) report. It may well be that it's a dupe, or it may be something that looks similar but not actually the same. And indeed as in this case it's only the follow up report that got the bug fixed. In this case it seems that contacts at google allowed them to escalate anyway and get it fixed. But so often and especially with other programs almost everything gets closed as "dupe" which is just dispiriting. In any case, if something this serious is a duplicate then there's the suspicion it went unfixed for long enough to be independently discovered and reported which is worrying.

j0hnyl 4y ago
I've reported some bugs to programs on Hackerone before that were flagged as dupe and the triager did reference the original report. Chrome team does this too.
Cthulhu_ 4y ago
> I wish closing things as "this is a duplicate" essentially required disclosure of the original (dupe) report. Only if it has been fixed and is allowed to be talked about, else malicious actors will submit speculative bugs to see if they catch anything.
- lupire 4y ago
  Speculative bug reports are irrelevant, since they don't have a repro/proof of concept.
acdha 4y ago
I’ve run into this with other vendors and really wished it’d get you CCed on updates so you didn’t have to ask for status periodically. It definitely doesn’t give a good impression when things drag out for aeons.
- lupire 4y ago
  What's crazy is that it's 100% in the vendor's interest to keep this person happy, who they know can cause massive damage to their system, completely legally. The only leverage they have is the reporter's greed to get a bounty.
  - jbuhbjlnjbn 4y ago
    It's not greed to hold a company accountable to its promises of compensation. Even so, surprisingly many researchers disclose a bug after setting a reasonable fix deadline, risking to forfeit compensation. Kudos to them!
rkagerer 4y ago
Yeah for purposes of the reward it should only be allowed to be considered a dupe if it duplicates a disclosed bug.
- laurencei 4y ago
  I suppose the risk is people could 'game' the system. Person A finds the issue, reports it. Then Person A secretly tells Person B about it (with no apparent connection), and Person B reports the same issues a few weeks later, but with apparent different code/description to look ever so slightly different.
  - Gasp0de 4y ago
    Split the reward between everyone who reported it. It's even still kind of fair: The more people find it the easier it was to find.
    - bornfreddy 4y ago
      Of course, then when A and B independently find a bug, B can enlist C, D and E, thus taking 80% instead of 50% of the bounty. No system is perfect.
- Someone1234 4y ago
  I agree, but just to play devil's advocate if I discover a bug, disclose it, then tell all my friends to also file a report before it is filed they'd have to honor multiple bounties. I, too, am frustrated that I've read far too many stories about someone reporting a devastating critical exploit and all they get is "this is a dupe" back without further explanation. Makes one paranoid that employees are working with someone externally, back dating their bug reports, and splitting the bounty.
  - tedivm 4y ago
    You'd probably violate the agreement so you and everyone else technically wouldn't qualify and would be committing fraud. That said there are other options, such as splitting the reward for a vulnerability amongst those who report it (even the dupes). This would incentivize people not to disclose the vulnerabilities while keeping the payouts static.
ZiiS 4y ago
Everyone who reports a undisclosed bug should get a share of the bounty; this incentivizes them to stick to the embargo. If too many people are reporting the bug before you fix it then you have other problems. I also start to feel that at Google's scale bounties this serious should start doubling every month.
- bawolff 4y ago
  Do you mean each new person should get a new bounty, or all reporters should split the bounty? The latter does not really incentivize much, but the former incentivizes reporters to collude with other reporters (i.e. you find a bug, tell your 40 friends to report the same bug, you get a kickback from all your friends who also reported it. $$$$).
  - Gasp0de 4y ago
    The latter does incentivize everyone who stumbles across the bug to not disclose it. At the same time, it's sad for the original researcher whose bounty gets smaller with every new person stumbling across it.
    - ZiiS 4y ago
      It dose imply that finding it was easier then ones where you are the only reporter; partially justifying lower rewards.
      - cwkoss 4y ago
        No. A bug that can be trivially found is higher likelihood of being exploited, and thus higher impact.
        ZiiS 4y ago
        Higher impact; but if it is just luck you are the first of many to find it and did not invest a lot of work in its discovery is reasonable to pay less. Under "Closed as dup" system the probability is you get nothing for reporting trivially found bugs. Whilst you are still providing valuable information (that lots of people can find it).
bawolff 4y ago
Surely in this case, the second report must have added some details, since they weren't fixing the original report and i assume android doesn't just sit on lock bypasses. Seems to me that if you report something that significantly recontextualizes a previous report (e.g. make it go from a low to a high severity), then your report shouldn't be considered a dupe.
deleted 4y ago
[deleted]

by eterm 4y ago

j0hnyl 4y ago

I've reported some bugs to programs on Hackerone before that were flagged as dupe and the triager did reference the original report. Chrome team does this too.

Cthulhu_ 4y ago

> I wish closing things as "this is a duplicate" essentially required disclosure of the original (dupe) report. Only if it has been fixed and is allowed to be talked about, else malicious actors will submit speculative bugs to see if they catch anything.

lupire 4y ago
Speculative bug reports are irrelevant, since they don't have a repro/proof of concept.

acdha 4y ago

I’ve run into this with other vendors and really wished it’d get you CCed on updates so you didn’t have to ask for status periodically. It definitely doesn’t give a good impression when things drag out for aeons.

lupire 4y ago
What's crazy is that it's 100% in the vendor's interest to keep this person happy, who they know can cause massive damage to their system, completely legally. The only leverage they have is the reporter's greed to get a bounty.
- jbuhbjlnjbn 4y ago
  It's not greed to hold a company accountable to its promises of compensation. Even so, surprisingly many researchers disclose a bug after setting a reasonable fix deadline, risking to forfeit compensation. Kudos to them!

rkagerer 4y ago

Yeah for purposes of the reward it should only be allowed to be considered a dupe if it duplicates a disclosed bug.

laurencei 4y ago
I suppose the risk is people could 'game' the system. Person A finds the issue, reports it. Then Person A secretly tells Person B about it (with no apparent connection), and Person B reports the same issues a few weeks later, but with apparent different code/description to look ever so slightly different.
- Gasp0de 4y ago
  Split the reward between everyone who reported it. It's even still kind of fair: The more people find it the easier it was to find.
  - bornfreddy 4y ago
    Of course, then when A and B independently find a bug, B can enlist C, D and E, thus taking 80% instead of 50% of the bounty. No system is perfect.
Someone1234 4y ago
I agree, but just to play devil's advocate if I discover a bug, disclose it, then tell all my friends to also file a report before it is filed they'd have to honor multiple bounties. I, too, am frustrated that I've read far too many stories about someone reporting a devastating critical exploit and all they get is "this is a dupe" back without further explanation. Makes one paranoid that employees are working with someone externally, back dating their bug reports, and splitting the bounty.
- tedivm 4y ago
  You'd probably violate the agreement so you and everyone else technically wouldn't qualify and would be committing fraud. That said there are other options, such as splitting the reward for a vulnerability amongst those who report it (even the dupes). This would incentivize people not to disclose the vulnerabilities while keeping the payouts static.

ZiiS 4y ago

Everyone who reports a undisclosed bug should get a share of the bounty; this incentivizes them to stick to the embargo. If too many people are reporting the bug before you fix it then you have other problems. I also start to feel that at Google's scale bounties this serious should start doubling every month.

bawolff 4y ago
Do you mean each new person should get a new bounty, or all reporters should split the bounty? The latter does not really incentivize much, but the former incentivizes reporters to collude with other reporters (i.e. you find a bug, tell your 40 friends to report the same bug, you get a kickback from all your friends who also reported it. $$$$).
- Gasp0de 4y ago
  The latter does incentivize everyone who stumbles across the bug to not disclose it. At the same time, it's sad for the original researcher whose bounty gets smaller with every new person stumbling across it.
  - ZiiS 4y ago
    It dose imply that finding it was easier then ones where you are the only reporter; partially justifying lower rewards.
    - cwkoss 4y ago
      No. A bug that can be trivially found is higher likelihood of being exploited, and thus higher impact.
      - ZiiS 4y ago
        Higher impact; but if it is just luck you are the first of many to find it and did not invest a lot of work in its discovery is reasonable to pay less. Under "Closed as dup" system the probability is you get nothing for reporting trivially found bugs. Whilst you are still providing valuable information (that lots of people can find it).

bawolff 4y ago

Surely in this case, the second report must have added some details, since they weren't fixing the original report and i assume android doesn't just sit on lock bypasses. Seems to me that if you report something that significantly recontextualizes a previous report (e.g. make it go from a low to a high severity), then your report shouldn't be considered a dupe.

deleted 4y ago

[deleted]