4 ms·

When you turn actual, creative and exhausting work (vulnerability research) into some kind of high stakes gig job you deserve this problem. I am not against bu

When you turn actual, creative and exhausting work (vulnerability research) into some kind of high stakes gig job you deserve this problem. I am not against bug hunting by any means, but if you want to me act like I care about your product and not about my money, pay me monthly.

Aurornis 3y ago
> When you turn actual, creative and exhausting work (vulnerability research) into some kind of high stakes gig job you deserve this problem. You don’t make HackerOne your primary source of security testing. It’s a fun thing you do in addition to your formal security work internally. The reason people do it is because so many people expect or even demand payment and public recognition for submitting security issues they found. Just look at how many comments in this thread are insisting that they pay the author various amounts of money. The blog post even has a line about how they have not provided recognition (despite being posted exactly on the day it was fixed, giving the company almost no time to actually do so). HackerOne style programs provide a way to formalize this, publicize the rules (e.g we pay $25K for privilege escalation or something) and give recognition to people finding the bugs. Pentesters like it not only because they get paid, but now they can point to their record on a public website. This isn’t a “gig economy bad” situation.
- j0hnyl 3y ago
  Furthermore, companies that don't already have very mature security programs will not benefit from bug bounties. I've run a bug bounty program before on H1, and it was a nightmare. No one reads the scope and you're inundated with 99/100 really trashy reports. Managing such a program is a full time job for one or more people especially if it's a big company.
LMYahooTFY 3y ago
How do you measure productivity? How do you budget for a bug hunting department?
- advael 3y ago
  Measuring productivity in a useful way is pretty close to impossible in a vast swath of jobs, though people make a killing (and make everyone involved considerably more miserable) pretending otherwise The reason most people have converged on a preference for salaried work is that most jobs don't actually need consistency to be useful, but most people do need consistent pay to focus on a job
marcod 3y ago
Most vulnerability reports I see at work come from security researchers in Pakistan and India. I have never found out if this is a side gig, a full-time job, or a hobby for people.

Aurornis 3y ago

> When you turn actual, creative and exhausting work (vulnerability research) into some kind of high stakes gig job you deserve this problem. You don’t make HackerOne your primary source of security testing. It’s a fun thing you do in addition to your formal security work internally. The reason people do it is because so many people expect or even demand payment and public recognition for submitting security issues they found. Just look at how many comments in this thread are insisting that they pay the author various amounts of money. The blog post even has a line about how they have not provided recognition (despite being posted exactly on the day it was fixed, giving the company almost no time to actually do so). HackerOne style programs provide a way to formalize this, publicize the rules (e.g we pay $25K for privilege escalation or something) and give recognition to people finding the bugs. Pentesters like it not only because they get paid, but now they can point to their record on a public website. This isn’t a “gig economy bad” situation.

j0hnyl 3y ago
Furthermore, companies that don't already have very mature security programs will not benefit from bug bounties. I've run a bug bounty program before on H1, and it was a nightmare. No one reads the scope and you're inundated with 99/100 really trashy reports. Managing such a program is a full time job for one or more people especially if it's a big company.

LMYahooTFY 3y ago

How do you measure productivity? How do you budget for a bug hunting department?

advael 3y ago
Measuring productivity in a useful way is pretty close to impossible in a vast swath of jobs, though people make a killing (and make everyone involved considerably more miserable) pretending otherwise The reason most people have converged on a preference for salaried work is that most jobs don't actually need consistency to be useful, but most people do need consistent pay to focus on a job

marcod 3y ago

Most vulnerability reports I see at work come from security researchers in Pakistan and India. I have never found out if this is a side gig, a full-time job, or a hobby for people.