6 ms·

> XBOW submitted nearly 1,060 vulnerabilities. Yikes, explains why my manually submitted single vulnerability is taking weeks to triage.

tptacek 1y ago
The XBOW people are not randos.
- lcnPylGDnU4H9OF 1y ago
  That's not their point, I think. They're just saying that those nearly 1060 vulnerabilities are being processed so theirs is being ignored (hence "triage").
  - tptacek 1y ago
    If that's all they're saying then there isn't much to do with the sentiment; if you're legit-finding #1061 after legit-findings #1-#1060, that's just life in the NFL. I took instead the meaning that the findings ahead of them were less than legit.
    - croes 1y ago
      Whether it is legit-finding is precisely what needs to be checked, but you’re at spot 1061. >130 resolved >303 were classified as Triaged >33 reports marked as new >125 remain pending >208 were marked as duplicates >209 as informative >36 not applicable 20% bind a lot of resources if you have a high input on submissions and the numbers will rise
      - tptacek 1y ago
        I think some context I probably don't share with the rest of this thread is that the average quality of a Hacker One submission is incredibly low. Like however bad you think the median bounty submission is, it's worse; think "people threatening to take you to court for not paying them for their report that they can 'XSS' you with the Chrome developer console".
        croes 1y ago
        We‘ll get this low quality submissions with AI too. The problem is that the people who know how to use AI properly will slower and more careful in their submissions. Many others won’t, so we‘ll get lots of noise hiding the real issues. AI makes it easy to produce many bad results in short time.
        tptacek 1y ago
        Everyone already agrees with that; the interesting argument here is that it also makes it easy to produce many good results in short time.
        croes 1y ago
        But the good ones don’t have the same output rate because they are checked by humans before submission. They are faster than the purely manual ones but can’t beat the AI created bad ones neither in speed nor numbers. It’s like the IT security version of the Gish gallop.
        tptacek 1y ago
        Then you're refuting the premise of the article, and you should be more specific in your critique, because right now all you're saying is "this can't work".
        peanut-walrus 1y ago
        My favorite one I've seen is "open redirect when you change the domain name in the browser address bar". This was submitted twice several years apart by two different people.
        aspenmayer 1y ago
        I can’t speak to the average quality of submissions, as I’ve only made one to HackerOne myself iirc. I don’t even consider myself good at coding or aware of how to file a bug report or bounty submission. I reported that on iOS Coinbase app, that if you were on a VPN, the Coinbase app PIN simply didn’t exist anymore, and did not appear in the settings as enabled either. I included a full video of this occurring and it seemed reproducible. The Coinbase person said that this was not an issue because you would already need access to the physical device and know the iOS passcode; relevant to this is that at the time (2021) and maybe now, the Coinbase iOS app didn’t hook the iOS passcode for access control, like Signal or other apps do, but instead has its own app passcode. The fact that this was circumventable by adding and connecting to any VPN on the same iOS device seemed like a bug in the implementation, even if it is the code working as written. The issue was closed and I lost 5 HackerRank I think the points are called. It felt very hostile to my efforts that I lost points, since I don’t think that was justified. Perhaps that is just how the platform works for denied bug reports on HackerOne, but I have no way of knowing that, as the Coinbase report is the only time I used the platform.
    - lcnPylGDnU4H9OF 1y ago
      > there isn't much to do with the sentiment I see what you're saying but I think a more charitable interpretation can be made. They may be amazed that so many bug reports are being generated by such a reputable group. Looking at your initial reply, perhaps a more constructive comment could be one that joins them in excitement (even if that assumption is erroneous) and expanding on why you think it is exciting (e.g. this group's reputation for quality).
    - stronglikedan 1y ago
      > I took instead the meaning that the findings ahead of them were less than legit. I took instead the opposite - that they were no longer shocked that it was taking so long once they found out why, as they knew who they were and understood.
k0ns0l 1y ago
:(

tptacek 1y ago

The XBOW people are not randos.

lcnPylGDnU4H9OF 1y ago
That's not their point, I think. They're just saying that those nearly 1060 vulnerabilities are being processed so theirs is being ignored (hence "triage").
- tptacek 1y ago
  If that's all they're saying then there isn't much to do with the sentiment; if you're legit-finding #1061 after legit-findings #1-#1060, that's just life in the NFL. I took instead the meaning that the findings ahead of them were less than legit.
  - croes 1y ago
    Whether it is legit-finding is precisely what needs to be checked, but you’re at spot 1061. >130 resolved >303 were classified as Triaged >33 reports marked as new >125 remain pending >208 were marked as duplicates >209 as informative >36 not applicable 20% bind a lot of resources if you have a high input on submissions and the numbers will rise
    - tptacek 1y ago
      I think some context I probably don't share with the rest of this thread is that the average quality of a Hacker One submission is incredibly low. Like however bad you think the median bounty submission is, it's worse; think "people threatening to take you to court for not paying them for their report that they can 'XSS' you with the Chrome developer console".
      - croes 1y ago
        We‘ll get this low quality submissions with AI too. The problem is that the people who know how to use AI properly will slower and more careful in their submissions. Many others won’t, so we‘ll get lots of noise hiding the real issues. AI makes it easy to produce many bad results in short time.
        tptacek 1y ago
        Everyone already agrees with that; the interesting argument here is that it also makes it easy to produce many good results in short time.
        croes 1y ago
        But the good ones don’t have the same output rate because they are checked by humans before submission. They are faster than the purely manual ones but can’t beat the AI created bad ones neither in speed nor numbers. It’s like the IT security version of the Gish gallop.
        tptacek 1y ago
        Then you're refuting the premise of the article, and you should be more specific in your critique, because right now all you're saying is "this can't work".
      - peanut-walrus 1y ago
        My favorite one I've seen is "open redirect when you change the domain name in the browser address bar". This was submitted twice several years apart by two different people.
      - aspenmayer 1y ago
        I can’t speak to the average quality of submissions, as I’ve only made one to HackerOne myself iirc. I don’t even consider myself good at coding or aware of how to file a bug report or bounty submission. I reported that on iOS Coinbase app, that if you were on a VPN, the Coinbase app PIN simply didn’t exist anymore, and did not appear in the settings as enabled either. I included a full video of this occurring and it seemed reproducible. The Coinbase person said that this was not an issue because you would already need access to the physical device and know the iOS passcode; relevant to this is that at the time (2021) and maybe now, the Coinbase iOS app didn’t hook the iOS passcode for access control, like Signal or other apps do, but instead has its own app passcode. The fact that this was circumventable by adding and connecting to any VPN on the same iOS device seemed like a bug in the implementation, even if it is the code working as written. The issue was closed and I lost 5 HackerRank I think the points are called. It felt very hostile to my efforts that I lost points, since I don’t think that was justified. Perhaps that is just how the platform works for denied bug reports on HackerOne, but I have no way of knowing that, as the Coinbase report is the only time I used the platform.
  - lcnPylGDnU4H9OF 1y ago
    > there isn't much to do with the sentiment I see what you're saying but I think a more charitable interpretation can be made. They may be amazed that so many bug reports are being generated by such a reputable group. Looking at your initial reply, perhaps a more constructive comment could be one that joins them in excitement (even if that assumption is erroneous) and expanding on why you think it is exciting (e.g. this group's reputation for quality).
  - stronglikedan 1y ago
    > I took instead the meaning that the findings ahead of them were less than legit. I took instead the opposite - that they were no longer shocked that it was taking so long once they found out why, as they knew who they were and understood.

k0ns0l 1y ago