7 ms·
A $1.3 billion revenue company being too tight to pay this after all, even on their 2nd chance, is so short-sighted it's absurd. They're putting out a huge sign
by maeil 2y ago
A $1.3 billion revenue company being too tight to pay this after all, even on their 2nd chance, is so short-sighted it's absurd. They're putting out a huge sign saying "When you find a vuln, definitely contact all our clients because we won't be giving you a penny!".
Incredible. This must be some kind of "damaged ego" or ass-covering, as it's clearly not a rational decision.
Edit: Another user here has pointed out the reasoning
> It's owned by private equity. Slowly cutting costs and bleeding the brand dry
- paulpauper 2y agoIf the bounty is big enough you basically need to retain a lawyer so the whole thing is done right and prevent being scammed.
- gavingmiller 2y agozendesk is 6k employees, they have general council on staff
- genter 2y agoI think paulpauper is saying the researcher that finds the vulnerability needs a lawyer.
- pphysch 2y agoI thought the point of bug bounties was to incentivize whitehat behavior, not scare them off with legal BS. Lol.
- hinkley 2y agoTarpit?
- paulpauper 2y agocorrect
- zer0x4d 2y agoThis is worse than Docusign. What do 6000 people at Zendesk do? It's a simple ticket management software with maybe 10 features
- teaearlgraycold 2y agoI look at the Docusign building every day and shake my head. 20 stories of office space!
- pavlov 2y agoSoftware developers being surprised that software companies need to do a lot more than just write code is kind of like sailors being surprised that global logistics involves a lot more than handling a ship.
- appendix-rock 2y agoStill naive enough to buy into the lie that they can just be “left alone to do the REAL work” and a business just…spontaneously appears around them.
- ozim 2y agoSolopreneurs making millions just like Pieter Levels are giving wrong impression.
- echoangle 2y agoI am actually seriously interested in what people there do day to day. I’m wondering this about a lot of very large companies, I would definitely watch a documentary about that.
- ianmcgowan 2y agoJust re-watch Office Space..
- 2y ago
- mmsc 2y agoIt all makes sense if you consider bug bounties are largely: 1) created for the purpose of either PR/marketing, or a checklist ("auditing"), 2) seen as a cheaper alternative to someone who knows anything about security - "why hire someone that actually knows anything about security when we can just pay a pittance to strangers and believe every word they say?" The amusing and ironic thing about the second point is that by doing so, you waste time with the constant spam of people begging for bounties and reporting things that are not even bugs let alone security issues, and your attention is therefore taken away from real security benefits which could be realized elsewhere by talented staff members.
- richbell 2y ago> you waste time with the constant spam of people begging for bounties A great blog post on the matter https://www.troyhunt.com/beg-bounties/ https://www.troyhunt.com/beg-bounties/
- samatman 2y ago[flagged]
- two_handfuls 2y agoIt's a great read, but it looks like a number of the screenshots are missing.
- richbell 2y ago
- kozikow 2y ago> A $1.3 billion revenue company being too tight to pay this after all, even on their 2nd chance, is so short-sighted it's absurd. I'll give an "another side" perspective. My company was much smaller. Out of 10+ "I found a vulnerability" emails I got last year, all were something like mass-produced emails generated based on an automated vulnerability scanning tool. Investigating all of those for "is it really an issue" is more work than it seems. For many companies looking to improve security, there are higher ROI things to do than investigating all of those emails.
- DaiPlusPlus 2y agoWe have a policy to never acknowledge unsolicited emails like that unless they follow the simple instructions set-out in our /.well-known/security.txt file (see https://en.wikipedia.org/wiki/Security.txt https://en.wikipedia.org/wiki/Security.txt) - honestly all they have to do is put “I put a banana in my fridge” as the message subject (or use PGP/GPG/SMIME) and it’ll be instantly prioritised. The logic being that any actual security-researcher with even minimal levels of competency will know to check the security.txt file and can follow basic instructions; while if any of our actual (paying) users find a security issue then they’ll go through our internal ticket site and not public e-mail anyway - so all that’s left are low-effort vuln-scanner reports - and it’s always the same non-issues like clickjacking (but only when using IE9 for some reason, even though it’s 2024 now…) or people who think their browser’s Web Inspector is a “hacking tool” that allows anyone to edit any data in our system… And FWIW, I’ve never received a genuine security issue report with an admission of kitchen refrigeration of fruit in the 18 months we’ve had a security.txt file - it’s almost as-if qualified competent professionals don’t operate like an embarrassingly pathetic shakedown.
- hmottestad 2y agoI saw a great presentation from Finn.no on their bug bounty program. They had had great success, despite the amount of work it took. Much more so than the three different security companies they hired each year to find vulnerabilities. They also had a security.txt file and had received several emails through that, but all of it was spam. Ironically they had received more real security vulnerabilities through people contacting them on LinkedIn than through their security.txt file. Your milage may vary, but it didn’t seem like the security.txt file was read by the people one would hope would read it.
- jejeyyy77 2y agoit never made sense to me why these white-hat hackers don't require payment before disclosing the vulnerability
- tptacek 2y agoBug bounty people do this all the time. It's almost always a sign that your bug is something silly, like DKIM. Later I wrote this comment before rereading the original post and realizing that they had literally submitted a DKIM report (albeit a rare instance of a meaningful one). Just to be clear: in my original comment, I did not mean to suggest this bug was silly; only that in the world of security bug bounties, DKIM reports are universally viewed as silly.
- jejeyyy77 2y agowhat does it mean to say a bug is silly? only thing that matters is the severity and what it allows the attackers to do.