5 ms·

Bug bounties often involve a lot of risk for submitters. Often the person reading the report doesn't know that much and misinterprets it. Often rules are unclea

by bawolff 10mo ago

Bug bounties often involve a lot of risk for submitters. Often the person reading the report doesn't know that much and misinterprets it. Often rules are unclear about what sort of reports are wanted. A pay to enter would increase that risk. Honestly bug bounties are kind of miserable for both sides. I've worked on the recieving side of bug bounty programs. You wouldnt believe the shit that is submitted. This was before AI and it was significant work to sort through, i can only imagine what its like now. On the other hand for a submitter, you are essentially working on spec with no garuntee your work is going to be evaluated fairly. Even if it is, you are rolling the dice that your report is not a duplicate of an issue reported 10 years ago that the company just doesn't feel like fixing.

ANarrativeApe 10mo ago
Pay to enter would increase the risk of submitting a bug report. However, if the submission fees were added to the bounty payable, then the risk reward changes in favour of the submitter of genuine bugs. You could even have refund the submission fee in the case of a good faith non bug submission. A little game theory can go a long way in improving the bug bounty system...
- CTDOCodebases 10mo ago
  They could allow submitters to double down on submissions escalating the bug to more skilled and experienced code reviewers who get a cut of the doubled submission fee for reviews.
- bawolff 10mo ago
  If a competent neutral party was evaluating them, i would agree. However currently these things tend to be luck of a draw.
- airza 10mo ago
  You’re assuming that the companies operating these programs would act in good faith which they often do not.
eterm 10mo ago
Indeed, increasing the incentive for companies to reject ( and then sometimes silently fix anyway ) even the valid reports would only increase further misery for everyone.
skirge 10mo ago
Real risk is missed security issue
- groundzeros2015 10mo ago
  You’re not addressing any of the points made.
entuno 10mo ago
Vulnerability disclosure is general is just miserable. Before all the bug bounty issues it was pretty common to: * Spend ages trying to find someone to submit a report to. * Waste a whole load of time fighting through the generic contact and support desks to try and get your report to someone who understood it. * Get completely ignored by the developers. * Spend time reporting a bug only for them to silently fix it without even bothering to respond to you, let alone acknowledge you. * Get legal threats for making a good-faith bug report, even if you found it in an locally deployed instance of the software. * Get called a black hat and more legal threats when you give up and just go down the full disclosure route.
freedomben 10mo ago
Indeed. I've also gotten a lot of "Hey I found a super critical security bug that makes your system ass, but if you pay me first I'll tell you what it is" types of submissions. Sometimes it's a hybrid, like something semi-legitimate but weak that they disclose up front, closing with a "and I've got another one that's juicy but you have to pay me first to hear it". Oh and then of course there is the flood of people who just scanned our infra with Nessus and screenshotted part of the report (often with important details blacked out so we can't see them unless we pay). As someone who has been on both sides of it as well, it just feels like everything is terrible

by bawolff 10mo ago

ANarrativeApe 10mo ago

Pay to enter would increase the risk of submitting a bug report. However, if the submission fees were added to the bounty payable, then the risk reward changes in favour of the submitter of genuine bugs. You could even have refund the submission fee in the case of a good faith non bug submission. A little game theory can go a long way in improving the bug bounty system...

CTDOCodebases 10mo ago
They could allow submitters to double down on submissions escalating the bug to more skilled and experienced code reviewers who get a cut of the doubled submission fee for reviews.
bawolff 10mo ago
If a competent neutral party was evaluating them, i would agree. However currently these things tend to be luck of a draw.
airza 10mo ago
You’re assuming that the companies operating these programs would act in good faith which they often do not.

eterm 10mo ago

Indeed, increasing the incentive for companies to reject ( and then sometimes silently fix anyway ) even the valid reports would only increase further misery for everyone.

skirge 10mo ago

Real risk is missed security issue

groundzeros2015 10mo ago
You’re not addressing any of the points made.

entuno 10mo ago

Vulnerability disclosure is general is just miserable. Before all the bug bounty issues it was pretty common to: * Spend ages trying to find someone to submit a report to. * Waste a whole load of time fighting through the generic contact and support desks to try and get your report to someone who understood it. * Get completely ignored by the developers. * Spend time reporting a bug only for them to silently fix it without even bothering to respond to you, let alone acknowledge you. * Get legal threats for making a good-faith bug report, even if you found it in an locally deployed instance of the software. * Get called a black hat and more legal threats when you give up and just go down the full disclosure route.

freedomben 10mo ago

Indeed. I've also gotten a lot of "Hey I found a super critical security bug that makes your system ass, but if you pay me first I'll tell you what it is" types of submissions. Sometimes it's a hybrid, like something semi-legitimate but weak that they disclose up front, closing with a "and I've got another one that's juicy but you have to pay me first to hear it". Oh and then of course there is the flood of people who just scanned our infra with Nessus and screenshotted part of the report (often with important details blacked out so we can't see them unless we pay). As someone who has been on both sides of it as well, it just feels like everything is terrible