4 ms·

> No contact or thanks has been received back so far WTF.

troupe 3y ago
I'm curious if the best monetary approach for a white hat hacker would be to show them the problem, give them time to fix it, and then give them an option to pay a consulting fee for the discovery in exchange for NOT publishing the exploit (after it has been fixed). The idea being the showing what you have found on other sites has marketing value for a white hat hacker, but had the company hired you to discover the flaw, you wouldn't be publishing it.
- jacobsenscott 3y ago
  The best approach is not to do it. Demanding money from someone that didn't hire you is never ethical - just childish. Would you like it if I showed up at your house, mowed your lawn, and then started banging on your door demanding $100 for mowing your lawn? Also, what marketing value - if you're just pwning random web sites rather than getting hired to test a site's security you aren't in any market.
  - z3phyr 3y ago
    The grass in the lawn may not be that dangerous to other people. However, if your house is emitting radiation, and a hero breaks in to clean it up for the sake of other people you service, (because the town does not need to wait for you to hire someone) the hero deserves a reward and the owner of the house deserves punishment.
    - hnfong 3y ago
      Unless the "hero" is law enforcement or some other government agent with a warrant, he will likely have broken a bunch of laws by breaking into a person's house uninvited, and not very likely rewarded. That's modern society for ya.
  - troupe 3y ago
    > what marketing value Most people who are doing this type of things offer consulting services to help make sure your site / app are secure. > The best approach is not to do it. Don't do what? Don't tell them there is a security problem? > Demanding money from someone that didn't hire you is never ethical - just childish. Lets say my front door is open. Someone takes a picture of it and sends it to me so I can close and lock it. Once it is closed, they explain that they offer a service where they will help homeowners make sure that they keep their doors closed. They plan to use the picture they took to illustrate how they help identify open doors to show why people might want to be their client. However, if I want to pay them for the service the provided, then I get to decide if and how any information about my door being open is used.
- hnfong 3y ago
  > give them an option to pay a consulting fee for the discovery in exchange for NOT publishing the exploit (after it has been fixed) I'm not making any moral judgments, but purely from a legal perspective this sounds dangerously like blackmail. If anyone decides to take this path, be sure you understand the risks involved.
- KomoD 3y ago
  > and then give them an option to pay a consulting fee for the discovery in exchange for NOT publishing the exploit (after it has been fixed). So... you're suggesting blackmail?
KomoD 3y ago
It's pretty common in my experience, especially from larger companies Recently I reported an issue to a company valued at >$10bil issues were quietly fixed, not a single response back, not even a "thank you"
- philsnow 3y ago
  Some companies intentionally Gray Rock security reports, because they neither want to attract attention by giving bounties, nor do they want attention for not giving bounties. If they just say nothing, the researcher usually just leaves them alone. One could speculate that these companies want to pretend that infosec isn't a problem for them, and if they ignore the "problem", it will go away.
paxys 3y ago
It has been less than a day, relax
- ConSeannery 3y ago
  It was reported to them in September of last year
  - paxys 3y ago
    Read the dates again
dataengineer56 3y ago
They fixed the bug which is the important thing. Corresponding back to the hacker probably involves the legal dept and it's probably safer to not respond at all.

I'm curious if the best monetary approach for a white hat hacker would be to show them the problem, give them time to fix it, and then give them an option to pay a consulting fee for the discovery in exchange for NOT publishing the exploit (after it has been fixed). The idea being the showing what you have found on other sites has marketing value for a white hat hacker, but had the company hired you to discover the flaw, you wouldn't be publishing it.

jacobsenscott 3y ago
The best approach is not to do it. Demanding money from someone that didn't hire you is never ethical - just childish. Would you like it if I showed up at your house, mowed your lawn, and then started banging on your door demanding $100 for mowing your lawn? Also, what marketing value - if you're just pwning random web sites rather than getting hired to test a site's security you aren't in any market.
- z3phyr 3y ago
  The grass in the lawn may not be that dangerous to other people. However, if your house is emitting radiation, and a hero breaks in to clean it up for the sake of other people you service, (because the town does not need to wait for you to hire someone) the hero deserves a reward and the owner of the house deserves punishment.
  - hnfong 3y ago
    Unless the "hero" is law enforcement or some other government agent with a warrant, he will likely have broken a bunch of laws by breaking into a person's house uninvited, and not very likely rewarded. That's modern society for ya.
- troupe 3y ago
  > what marketing value Most people who are doing this type of things offer consulting services to help make sure your site / app are secure. > The best approach is not to do it. Don't do what? Don't tell them there is a security problem? > Demanding money from someone that didn't hire you is never ethical - just childish. Lets say my front door is open. Someone takes a picture of it and sends it to me so I can close and lock it. Once it is closed, they explain that they offer a service where they will help homeowners make sure that they keep their doors closed. They plan to use the picture they took to illustrate how they help identify open doors to show why people might want to be their client. However, if I want to pay them for the service the provided, then I get to decide if and how any information about my door being open is used.
hnfong 3y ago
> give them an option to pay a consulting fee for the discovery in exchange for NOT publishing the exploit (after it has been fixed) I'm not making any moral judgments, but purely from a legal perspective this sounds dangerously like blackmail. If anyone decides to take this path, be sure you understand the risks involved.
KomoD 3y ago
> and then give them an option to pay a consulting fee for the discovery in exchange for NOT publishing the exploit (after it has been fixed). So... you're suggesting blackmail?

KomoD 3y ago

It's pretty common in my experience, especially from larger companies Recently I reported an issue to a company valued at >$10bil issues were quietly fixed, not a single response back, not even a "thank you"

philsnow 3y ago
Some companies intentionally Gray Rock security reports, because they neither want to attract attention by giving bounties, nor do they want attention for not giving bounties. If they just say nothing, the researcher usually just leaves them alone. One could speculate that these companies want to pretend that infosec isn't a problem for them, and if they ignore the "problem", it will go away.

paxys 3y ago

It has been less than a day, relax

ConSeannery 3y ago
It was reported to them in September of last year
- paxys 3y ago
  Read the dates again

dataengineer56 3y ago

They fixed the bug which is the important thing. Corresponding back to the hacker probably involves the legal dept and it's probably safer to not respond at all.