4 ms·
In a previous job i helped manage a security bug bounty program. It was worth it in that setting, because the 1% of reports that were real justified the time s
by bawolff 3y ago
In a previous job i helped manage a security bug bounty program.
It was worth it in that setting, because the 1% of reports that were real justified the time spent going through the mountain of BS. Security bugs are so bad we were willing to sink a lot of effort into finding them. 99% of reports were incoherent garbage often made by rude aggressive people who were difficult to deal with.
And to be clear, those 1% real reports weren't neccesarily good. They were often poorly explained. Sometimes the reporter didnt even know what they were reporting and had just happened to stumble on something interesting.
Now security vulns and actual code is really different but my experience with security bug bounties makes me think a code one would be an unmitigated disaster. All the bad parts of security bug bounties matter so much more when it comes to code.
In development, getting working code is barely half the battle. Bad quality code can be worse than no code. Making sure the code is not buggy is hard, making sure the code integrates well is hard, making sure its well tested is hard. Even ensuring it follows the not automatically testable coding conventions is important.
Bounties would just incentivize low quality drive by submissions, which helps nobody. Sorting through them would be a real cost that would outweigh any small benefits.
- throwawaymaths 3y agoTfa specifically excludes security bounties because there are often multiple security bugs, it's a discovery bounty and not a "compete for this one thing" scenario.
- bawolff 3y agoWell i agree with them but for different reasons. I also disagree about duplicates being a non issue in security bounties though. Its super common for multiple people to find the same bug. Even worse, security bugs are often kept secret so you dont know that someone has you just have to trust the project that it really is a dupe. Its one of the main reasons why sec bug bounties are unfair to researchers imo.
- deleted 3y ago[deleted]
- WelcomeShorty 3y agoThe "99% of reports were incoherent garbage" is exactly what I become from unsolicited sources. They come mainly in via our (security.txt) email. Since (2019) we have an externally managed bug bounty program (they have and manage the platform the initial triage of reports and paying the bounties (we decide what is accepted and how high the bounty is), our success rate (actionable reports) has sky rocketed. Our devs love the reports since these are verified to be 1: documented so well, everyone can reproduce them, 2: scored reasonable (much less in house fighting if it's a low or a critical), 3: simple interaction with the individual who triaged | filed the finding (and eliminating the horrible interaction via 3 or more steps). The money we spend on the bounties AND the service are easily offset by the quick turnaround times and saved internal struggles & meetings.