6 ms·

I assumed they offered a bounty for bug disclosure? You mean to tell me that an internet provider with 11 billion in revenue can't pay someone that found a bug

by imadr 2y ago

I assumed they offered a bounty for bug disclosure? You mean to tell me that an internet provider with 11 billion in revenue can't pay someone that found a bug impacting all their clients? Frankly he could have just sold the vulnerability to the highest bidder

cqqxo4zV46cp 2y ago
Don’t frame a company not parting ways with money that they could hypothetically part ways with as being unusually egregious. That’s never how it works. Not every conversation needs overstated outrage.
teruakohatu 2y ago
They do not: > Cox does not offer a bounty program or provide compensation in exchange for security vulnerability submissions. https://www.cox.com/aboutus/policies/cox-security-responsible-disclosure-policy.html https://www.cox.com/aboutus/policies/cox-security-responsibl...
- tetha 2y ago
  Mh, we have a similar thing on our website at work, but people who found serious issues still got compensated. One big reason to put this out there: Otherwise you get so many drive-by disclosures. Throw ZAP at the domain, copy all of the low and informational topics into a mail at security@domain and ask for a hundred bucks. Just sifting through that nonsense eventually takes up significant time. If you can just answer that with a link to this statement it becomes easier. It makes me a bit sad that this might scare off some motivated, well natured newbs poking at our API, but the spam drowned them out.
unclebucknasty 2y ago
>...can't pay someone that found a bug impacting all their clients?...he could have just sold the vulnerability to the highest bidder This attitude is why "independent security researchers" offering to present unsolicited findings to companies in exchange for payment feels exactly like extortion.
- zdimension 2y ago
  At the same time, Cox is a commercial entity that makes money by providing services. Cyberattacks make them lose money, so it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. We're not talking about a grandma losing her wallet with 50 bucks in it and not giving money to the guy that found it and gave her back.
  - unclebucknasty 2y ago
    >it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. Yes, Cox has that choice. But, what you're describing is the definition of extortion. The fact that it's easy for people to get away with it does not make it ethical.
    - bongodongobob 2y ago
      It's not the definition of extortion. If I walk past a business and notice the locks on their windows are rusted and I happen to be a lock guy and say hey, I noticed your locks are fucked, I'd be happy to consult for you and show you how and why they are broken, that's just doing business. Extortion is telling them, hey, your locks are fucked and I'm telling everyone unless you pay me. It requires a threat.
      - worewood 2y ago
        Great response, entirely agree.
      - unclebucknasty 2y ago
        You just manufactured a completely different scenario. The comment I responded to was this: >it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. That comment includes the threat ("instead of easily and anonymously selling those"). So, yes. That is the definition of extortion.
bayindirh 2y ago
> Frankly he could have just sold the vulnerability to the highest bidder Why? Ethics aside, is everything money?
- naikrovek 2y ago
  because money grants wishes, and having more money means you get more of your wishes granted.
  - bayindirh 2y ago
    That doesn't make me interested. I don't get all excited about the things money can buy. Edit: As I noted elsewhere, necessities are something else.
    - johnisgood 2y ago
      I would love to have the money (42k EUR) to buy Scewo, which is an advanced self balancing stair climbing wheelchair. Sadly enough, I doubt I will ever be able to.
    - WarOnPrivacy 2y ago
      May I suggest a decade of red state hunger-level poverty? My kids and I did it. Three years out of it, I get excited paying utilities on time.
    - Vicinity9635 2y ago
      [dead]
  - deleted 2y ago
    [deleted]
- robertlagrant 2y ago
  > Why? Ethics aside, is everything money? Ethics aside, why not? That's why we have ethics.

by imadr 2y ago

cqqxo4zV46cp 2y ago

Don’t frame a company not parting ways with money that they could hypothetically part ways with as being unusually egregious. That’s never how it works. Not every conversation needs overstated outrage.

teruakohatu 2y ago

They do not: > Cox does not offer a bounty program or provide compensation in exchange for security vulnerability submissions. https://www.cox.com/aboutus/policies/cox-security-responsible-disclosure-policy.html https://www.cox.com/aboutus/policies/cox-security-responsibl...

tetha 2y ago
Mh, we have a similar thing on our website at work, but people who found serious issues still got compensated. One big reason to put this out there: Otherwise you get so many drive-by disclosures. Throw ZAP at the domain, copy all of the low and informational topics into a mail at security@domain and ask for a hundred bucks. Just sifting through that nonsense eventually takes up significant time. If you can just answer that with a link to this statement it becomes easier. It makes me a bit sad that this might scare off some motivated, well natured newbs poking at our API, but the spam drowned them out.

unclebucknasty 2y ago

>...can't pay someone that found a bug impacting all their clients?...he could have just sold the vulnerability to the highest bidder This attitude is why "independent security researchers" offering to present unsolicited findings to companies in exchange for payment feels exactly like extortion.

zdimension 2y ago
At the same time, Cox is a commercial entity that makes money by providing services. Cyberattacks make them lose money, so it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. We're not talking about a grandma losing her wallet with 50 bucks in it and not giving money to the guy that found it and gave her back.
- unclebucknasty 2y ago
  >it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. Yes, Cox has that choice. But, what you're describing is the definition of extortion. The fact that it's easy for people to get away with it does not make it ethical.
  - bongodongobob 2y ago
    It's not the definition of extortion. If I walk past a business and notice the locks on their windows are rusted and I happen to be a lock guy and say hey, I noticed your locks are fucked, I'd be happy to consult for you and show you how and why they are broken, that's just doing business. Extortion is telling them, hey, your locks are fucked and I'm telling everyone unless you pay me. It requires a threat.
    - worewood 2y ago
      Great response, entirely agree.
    - unclebucknasty 2y ago
      You just manufactured a completely different scenario. The comment I responded to was this: >it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. That comment includes the threat ("instead of easily and anonymously selling those"). So, yes. That is the definition of extortion.

bayindirh 2y ago

> Frankly he could have just sold the vulnerability to the highest bidder Why? Ethics aside, is everything money?

naikrovek 2y ago
because money grants wishes, and having more money means you get more of your wishes granted.
- bayindirh 2y ago
  That doesn't make me interested. I don't get all excited about the things money can buy. Edit: As I noted elsewhere, necessities are something else.
  - johnisgood 2y ago
    I would love to have the money (42k EUR) to buy Scewo, which is an advanced self balancing stair climbing wheelchair. Sadly enough, I doubt I will ever be able to.
  - WarOnPrivacy 2y ago
    May I suggest a decade of red state hunger-level poverty? My kids and I did it. Three years out of it, I get excited paying utilities on time.
  - Vicinity9635 2y ago
    [dead]
- deleted 2y ago
  [deleted]
robertlagrant 2y ago
> Why? Ethics aside, is everything money? Ethics aside, why not? That's why we have ethics.