3 ms·

Did they really send the T-shirt? It feels like it must be a joke. Imagine a meeting where some bureaucrat went to their boss and said "hey this person did us

Did they really send the T-shirt? It feels like it must be a joke. Imagine a meeting where some bureaucrat went to their boss and said "hey this person did us a huge favor, can I get a €30 budget to specially order them a gimmick t-shirt" followed by some correspondence where the government obtained their address and shirt size, yet bizarrely not their name. I can't believe that happened.

jeroenhd 2y ago
The real favour is not taking you to court for attempting to break into critical national infrastructure. The shirt is just a fun gimmick. Beats only sending a letter, in my opinion. Also, it's unlikely that they didn't just ask for the author's size and address. The standard disclosure process involves a temporary non-disclosure and negotiating if/when publication of the issue will take place. The author was pleased with the response, and the process has improved since this was published.
- krageon 2y ago
  That isn't a favour. The favour is finding the vulnerability and being nice enough to communicate to those who are impacted. If you as an organisation are shitty enough to view the reward for that a lack of punishment, nobody should be communicating that to you.
soneil 2y ago
They really send a t-shirt. And if you're really good .. a hoodie [0]. You could look at it the opposite way around - someone's come up with a genius idea to do a bug bounty on a beer budget. [0] https://english.ncsc.nl/latest/weblog/weblog/2022/i-am-on-the-wall-of-fame-of-ncsc-and-all-i-got https://english.ncsc.nl/latest/weblog/weblog/2022/i-am-on-th...
- boomboomsubban 2y ago
  I don't find the lack of a financial reward objectionable as long as it's clear one doesn't exist. The gimmick shirt also isn't an issue, though the process of distributing it amuses me. A team of government workers spending paid time deciding which security volunteer deserves the most nonfinancial recognition mildly irks me.

jeroenhd 2y ago

The real favour is not taking you to court for attempting to break into critical national infrastructure. The shirt is just a fun gimmick. Beats only sending a letter, in my opinion. Also, it's unlikely that they didn't just ask for the author's size and address. The standard disclosure process involves a temporary non-disclosure and negotiating if/when publication of the issue will take place. The author was pleased with the response, and the process has improved since this was published.

krageon 2y ago
That isn't a favour. The favour is finding the vulnerability and being nice enough to communicate to those who are impacted. If you as an organisation are shitty enough to view the reward for that a lack of punishment, nobody should be communicating that to you.

soneil 2y ago

They really send a t-shirt. And if you're really good .. a hoodie [0]. You could look at it the opposite way around - someone's come up with a genius idea to do a bug bounty on a beer budget. [0] https://english.ncsc.nl/latest/weblog/weblog/2022/i-am-on-the-wall-of-fame-of-ncsc-and-all-i-got https://english.ncsc.nl/latest/weblog/weblog/2022/i-am-on-th...

boomboomsubban 2y ago
I don't find the lack of a financial reward objectionable as long as it's clear one doesn't exist. The gimmick shirt also isn't an issue, though the process of distributing it amuses me. A team of government workers spending paid time deciding which security volunteer deserves the most nonfinancial recognition mildly irks me.