7 ms·

> Some guy is poking around our system looking for exploitable weaknesses. Should we tell him to go away? > Nah, let's pay him instead! is a solution, but obv

by sdwr 2y ago

> Some guy is poking around our system looking for exploitable weaknesses. Should we tell him to go away? > Nah, let's pay him instead! is a solution, but obviously can't be the solution. From a distance, white hat "vulnerability disclosures" start to look like a protection racket.

JacobThreeThree 2y ago
Not to mention, short term cost cutting is what ever business tends to prioritize. Companies would prefer not to pay anyone for anything, including random "researchers".
taatof 2y ago
> From a distance, white hat "vulnerability disclosures" start to look like a protection racket. A pretty big distance. If a mobster threatens to burn down a building unless you buy their "insurance", that's a protection racket. If someone finds a major fire code violation and threatens to tell the fire marshal about it unless they fix it within a certain timeframe, that's not a protection racket, even though there's technically a threat involved. If the building owner is a dick about it, then next time that person will probably just go directly to the fire marshal.
- sdwr 2y ago
  If the reporter is trying to get paid for not reporting, that's blackmail. If the blackmail is organized, it's a racket. Plus, if the attack surface is huge and/or fractal, you will never run out of exploits. The more you pay people to find them, the harder they look...
  - taatof 2y ago
    > If the reporter is trying to get paid for not reporting, that's blackmail. That's not what happened here and isn't usually what happens, though? The reporter usually gives a timeline for fixing the bug before reporting externally, and often extends that deadline if it's clear the Company is working on it. This is separate from bug bounty payments. > The more you pay people to find them, the harder they look... Yeah... that's the point...
    - lodovic 2y ago
      People will look for bugs regardless, better incentivize them to report to you first
  - OfficeChad 2y ago
    [dead]
neilv 2y ago
I agree that you don't want to create a protection racket market, and that's what I was thinking when I said "being alerted to their own security mess-ups". Your own staff and vendors are creating security vulnerabilities, and you wisely run a bounty program, to detect and alert you. And you only pay when they find a problem. It can be very economical hedge against both mistakes and systemic dysfunction. Also, if the researchers were criminally-inclined, they could make more money selling vulnerabilities to someone, not alerting you.

by sdwr 2y ago

JacobThreeThree 2y ago

Not to mention, short term cost cutting is what ever business tends to prioritize. Companies would prefer not to pay anyone for anything, including random "researchers".

taatof 2y ago

> From a distance, white hat "vulnerability disclosures" start to look like a protection racket. A pretty big distance. If a mobster threatens to burn down a building unless you buy their "insurance", that's a protection racket. If someone finds a major fire code violation and threatens to tell the fire marshal about it unless they fix it within a certain timeframe, that's not a protection racket, even though there's technically a threat involved. If the building owner is a dick about it, then next time that person will probably just go directly to the fire marshal.

sdwr 2y ago
If the reporter is trying to get paid for not reporting, that's blackmail. If the blackmail is organized, it's a racket. Plus, if the attack surface is huge and/or fractal, you will never run out of exploits. The more you pay people to find them, the harder they look...
- taatof 2y ago
  > If the reporter is trying to get paid for not reporting, that's blackmail. That's not what happened here and isn't usually what happens, though? The reporter usually gives a timeline for fixing the bug before reporting externally, and often extends that deadline if it's clear the Company is working on it. This is separate from bug bounty payments. > The more you pay people to find them, the harder they look... Yeah... that's the point...
  - lodovic 2y ago
    People will look for bugs regardless, better incentivize them to report to you first
- OfficeChad 2y ago
  [dead]

neilv 2y ago

I agree that you don't want to create a protection racket market, and that's what I was thinking when I said "being alerted to their own security mess-ups". Your own staff and vendors are creating security vulnerabilities, and you wisely run a bounty program, to detect and alert you. And you only pay when they find a problem. It can be very economical hedge against both mistakes and systemic dysfunction. Also, if the researchers were criminally-inclined, they could make more money selling vulnerabilities to someone, not alerting you.