2 ms·

Swag packages like these are a token of appreciation not a reward. The front page post in HN here is worth far more than few thousand dollars , don’t think eit

by manquer 11d ago

Swag packages like these are a token of appreciation not a reward. The front page post in HN here is worth far more than few thousand dollars , don’t think either organization is operating under purely financial transactional nature . Most people who find a dropped wallet will return it without evaluating the market value of your compromised identity or the contents of the wallet . Grateful owners may buy you a beer that doesn’t make them cheap , not everything is evaluated in purely money terms, and that is a good thing ?

sublinear 11d ago
Thank you for pushing back on one of the top disruptive bad-faith comments we see on HN. The follow up arguments will be that since billion dollar companies ultimately only care about their bottom line, so should we. I'm certain most of these comments mean well (to "open eyes" or whatever), but some of them really are on principle and blatant astroturfing.
- jazzpush2 11d ago
  It's nice to wax poetic, but they should absolutely pay the researchers here.
- r_lee 11d ago
  > The follow up arguments will be that since billion dollar companies ultimately only care about their bottom line, so should we. so it should be fought by giving them free work in the hopes that they'll finally feel guilty and then start paying proper bounties? like to me that just seems funny, as if they'd change anything if we'd keep rewarding them for not doing the right thing like, there's a reason regulation exists for all kinds of shit because otherwise companies would do all kinds of atrocities in hopes of cutting costs
  - sublinear 11d ago
    At some point, you will realize two things. First, you're being petty and just fighting fire with fire. Second, most of this research is fairly trivial. What you're instead encouraging is a race to the bottom. You're not going to kill off the companies you hate by withholding information. You don't even have that power anyway because by its very nature, security research is not secret. You're really just encouraging pessimistic groupthink and bad faith. This is why businesses can't be more open about their flaws. It's not that they're stupid and incompetent, but that the pitchforks come out. These are the seeds of dystopia. They would have eventually figured it out, but as an unfortunate incident with an outsized effect. As much as you wish it to be true, even the worst of these incidents will not kill their business. As much as you hate these businesses, their financial momentum will eventually cause the public to depend on them more. There's more at stake here than anyone's personal gain. It's naive to think otherwise. You're just manifesting broken windows and ignoring litter thinking you're fighting the man. This is straight up ghetto punk ass behavior wearing a white collar.
    - cindyllm 11d ago
      [dead]
    - r_lee 10d ago
      > You're just manifesting broken windows and ignoring litter thinking you're fighting the man. This is straight up ghetto punk ass behavior wearing a white collar. are you replying to the right person? I'm not hating on any business or trying to "kill" any business. I'm saying serve yourself, not them. if you have say, a 0 day on your hands, do what serves you best. is that "ghetto punk ass behavior"? what are you on about?
      - sublinear 10d ago
        > I'm saying serve yourself, not them. if you have say, a 0 day on your hands, do what serves you best. is that "ghetto punk ass behavior"? Yes. If you have say, managed to find an overlooked passage into an ostensibly high security building, "doing what serves you best" such as selling the information to some thugs, is in fact that kind of behavior.
        r_lee 10d ago
        I think that's a bit different. for real security bugs, like, you can literally sell them to brokers who sell them to governments. would selling stuff to the CIA be ghetto? morally, it depends. but after seeing so many posts of e.g. Google cheapskating on bug reports, it really makes no sense to me to participate in such a broken system. this case however is quite different as it was a B2B encounter and during vendor vetting like to me it just seems like a fair deal, if Google wants their bugs patched (which they can definitely afford to do) they'd just pay properly for serious bugs and so on, and everybody would be happy. it's not some kind of thing where they can't do anything about. maybe you can understand the angle I'm coming from?
      - DonHopkins 10d ago
        Making Nazi salutes, and defending people who do, is ghetto punk ass behavior.
  - manquer 11d ago
    > free work Don't know if I would call it that ? This was a potential customer reporting a result of an audit of a tool they are evaluating. This is frequent and normal activity in enterprise deals. Most of the time such reports are not critical vulnerabilities it would things like tenant configuration -what business would like versus what CISO will accept or risk acceptance of the product they are buying with monitoring or other prescription on access restrictions or a DPA and so on. It would be novel business model to spend ton of money in getting a prospect to late-deal stage where they are ready to do a security audio for you just so that part is "free" . Most companies wouldn't disclose(to the public) even if it was serious , that is not their job, they will report to internal teams and re-review on fix. Strix.ai has a benefit in doing so as they sell a scanning tool for this purpose so we get to hear of this.
  - sellmesoap 10d ago
    But don't forget there are also regulations so the regularly scheduled atrocities can keep happening!
- deleted 11d ago
  [deleted]
deleted 11d ago
[deleted]
flaunf221 11d ago
Wallets usually belong to real people with lives. We can empathize with them. Companies are not people. And they also don't and can't empathize with you.
- alluro2 11d ago
  "and can't empathize with you" - I don't really understand why such a perception of companies has been regurgitated and reinforced so much in US public, to the point where it's a blank excuse from ever expecting such a thing from a company. It's not true that it can't. The only reason to keep repeating that kind of worldview is to absolve companies behaving in shitty, toxic or downright evil ways. The law doesn't say companies MUST choose the most profitable choice at every turn, and even explicitly allows for good treatment of customers, community, employees etc as a viable business strategy (even if it's sad that it must be justified in that way).
  - ImPostingOnHN 11d ago
    I think the point is that companies are purely legal entities, and as such, cannot feel, much less empathize, simply by virtue of them not being living things
    - leptons 11d ago
      That's nonsense. "Companies" are not something non-human, they are run by humans, who do feel, empathize, and are living beings. Without these living-being humans, there would simply be no "company". Now how those humans that run the company behave is another thing - they are free to be greedy assholes, and a lot of them are, and some of them aren't - but that's still a human thing.
      - ImPostingOnHN 10d ago
        > "Companies" are not something non-human Yes, they are not humans. They are not even living creatures. They are mostly-legal entities mostly for the purpose of contracting with humans or other legal entities. > they are run by humans, who do feel, empathize, and are living beings This is usually true, but it is orthogonal to whether the company (a legal entity) itself is a biologically living creature, which is the only thing capable of feeling*. To put a point on it: my lawnmower is also run by humans, but it does not have empathy for any grass or people that gets in its way. It mostly just goes where it is steered. A company is like that, except with less touching grass. * — unless you want to argue semantics about what "feeling" means, even though the discussion is about "feeling" and "empathy" in the way humans experience it, and how that form of "empathy" does not exist for a nonliving legal entity which may or may not employ any actual humans
r_lee 11d ago
> The front page post in HN here is worth far more than few thousand dollars , don’t think either organization is operating under purely financial transactional nature . not always, especially if its just someone independent. iirc there was a guy here not too long ago who started dropping Windows 0days because Microsoft couldn't be assed to process his bug reports
- OkayPhysicist 11d ago
  That actually supports the point that people aren't acting under purely financial motivations. If the guy was purely following financial motivations, surely he would have chosen to sell the vulnerabilities to the shadier side of things. Instead, he dumped them publicly, burning their value while amplifying the "fuck you" factor to Microsoft. Ignoring reports, or just fixing the vulnerability without acknowledging the work put in by a researcher, is rude and invites rudeness in return.
- ivlad 11d ago
  Microsoft runs a bug bounty program. NightmareEclipse (that’s the researcher’s handle) allegedly participated and Microsoft did not honor their part of the bug bounty program terms. This is a completely different situation - a company evaluates the security of a prospective vendor prior to entering a business agreement.
- Aurornis 10d ago
  > iirc there was a guy here not too long ago who started dropping Windows 0days because Microsoft couldn't be assed to process his bug reports Did that ever actually happen? I remember him threatening to start dropping 0days and getting a lot of press coverage for it. When I tried to look it up I didn’t find anything at the time.
  - Barbing 10d ago
    > New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access https://bleepingcomputer.com/news/security/new-microsoft-defender-shieldcrash-zero-day-grants-system-access https://bleepingcomputer.com/news/security/new-microsoft-def... “Nightmare Eclipse released these zero-day exploits as part of an ongoing dispute with Microsoft over the company's bug bounty and vulnerability disclosure practices. […] Since April, the anonymous security researcher has disclosed a long list of zero-day flaws, including ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend, targeting Microsoft Defender, BitLocker, and other Windows components.”

by manquer 11d ago

sublinear 11d ago

Thank you for pushing back on one of the top disruptive bad-faith comments we see on HN. The follow up arguments will be that since billion dollar companies ultimately only care about their bottom line, so should we. I'm certain most of these comments mean well (to "open eyes" or whatever), but some of them really are on principle and blatant astroturfing.

jazzpush2 11d ago
It's nice to wax poetic, but they should absolutely pay the researchers here.
r_lee 11d ago
> The follow up arguments will be that since billion dollar companies ultimately only care about their bottom line, so should we. so it should be fought by giving them free work in the hopes that they'll finally feel guilty and then start paying proper bounties? like to me that just seems funny, as if they'd change anything if we'd keep rewarding them for not doing the right thing like, there's a reason regulation exists for all kinds of shit because otherwise companies would do all kinds of atrocities in hopes of cutting costs
- sublinear 11d ago
  At some point, you will realize two things. First, you're being petty and just fighting fire with fire. Second, most of this research is fairly trivial. What you're instead encouraging is a race to the bottom. You're not going to kill off the companies you hate by withholding information. You don't even have that power anyway because by its very nature, security research is not secret. You're really just encouraging pessimistic groupthink and bad faith. This is why businesses can't be more open about their flaws. It's not that they're stupid and incompetent, but that the pitchforks come out. These are the seeds of dystopia. They would have eventually figured it out, but as an unfortunate incident with an outsized effect. As much as you wish it to be true, even the worst of these incidents will not kill their business. As much as you hate these businesses, their financial momentum will eventually cause the public to depend on them more. There's more at stake here than anyone's personal gain. It's naive to think otherwise. You're just manifesting broken windows and ignoring litter thinking you're fighting the man. This is straight up ghetto punk ass behavior wearing a white collar.
  - cindyllm 11d ago
    [dead]
  - r_lee 10d ago
    > You're just manifesting broken windows and ignoring litter thinking you're fighting the man. This is straight up ghetto punk ass behavior wearing a white collar. are you replying to the right person? I'm not hating on any business or trying to "kill" any business. I'm saying serve yourself, not them. if you have say, a 0 day on your hands, do what serves you best. is that "ghetto punk ass behavior"? what are you on about?
    - sublinear 10d ago
      > I'm saying serve yourself, not them. if you have say, a 0 day on your hands, do what serves you best. is that "ghetto punk ass behavior"? Yes. If you have say, managed to find an overlooked passage into an ostensibly high security building, "doing what serves you best" such as selling the information to some thugs, is in fact that kind of behavior.
      - r_lee 10d ago
        I think that's a bit different. for real security bugs, like, you can literally sell them to brokers who sell them to governments. would selling stuff to the CIA be ghetto? morally, it depends. but after seeing so many posts of e.g. Google cheapskating on bug reports, it really makes no sense to me to participate in such a broken system. this case however is quite different as it was a B2B encounter and during vendor vetting like to me it just seems like a fair deal, if Google wants their bugs patched (which they can definitely afford to do) they'd just pay properly for serious bugs and so on, and everybody would be happy. it's not some kind of thing where they can't do anything about. maybe you can understand the angle I'm coming from?
    - DonHopkins 10d ago
      Making Nazi salutes, and defending people who do, is ghetto punk ass behavior.
- manquer 11d ago
  > free work Don't know if I would call it that ? This was a potential customer reporting a result of an audit of a tool they are evaluating. This is frequent and normal activity in enterprise deals. Most of the time such reports are not critical vulnerabilities it would things like tenant configuration -what business would like versus what CISO will accept or risk acceptance of the product they are buying with monitoring or other prescription on access restrictions or a DPA and so on. It would be novel business model to spend ton of money in getting a prospect to late-deal stage where they are ready to do a security audio for you just so that part is "free" . Most companies wouldn't disclose(to the public) even if it was serious , that is not their job, they will report to internal teams and re-review on fix. Strix.ai has a benefit in doing so as they sell a scanning tool for this purpose so we get to hear of this.
- sellmesoap 10d ago
  But don't forget there are also regulations so the regularly scheduled atrocities can keep happening!
deleted 11d ago
[deleted]

deleted 11d ago

[deleted]

flaunf221 11d ago

Wallets usually belong to real people with lives. We can empathize with them. Companies are not people. And they also don't and can't empathize with you.

alluro2 11d ago
"and can't empathize with you" - I don't really understand why such a perception of companies has been regurgitated and reinforced so much in US public, to the point where it's a blank excuse from ever expecting such a thing from a company. It's not true that it can't. The only reason to keep repeating that kind of worldview is to absolve companies behaving in shitty, toxic or downright evil ways. The law doesn't say companies MUST choose the most profitable choice at every turn, and even explicitly allows for good treatment of customers, community, employees etc as a viable business strategy (even if it's sad that it must be justified in that way).
- ImPostingOnHN 11d ago
  I think the point is that companies are purely legal entities, and as such, cannot feel, much less empathize, simply by virtue of them not being living things
  - leptons 11d ago
    That's nonsense. "Companies" are not something non-human, they are run by humans, who do feel, empathize, and are living beings. Without these living-being humans, there would simply be no "company". Now how those humans that run the company behave is another thing - they are free to be greedy assholes, and a lot of them are, and some of them aren't - but that's still a human thing.
    - ImPostingOnHN 10d ago
      > "Companies" are not something non-human Yes, they are not humans. They are not even living creatures. They are mostly-legal entities mostly for the purpose of contracting with humans or other legal entities. > they are run by humans, who do feel, empathize, and are living beings This is usually true, but it is orthogonal to whether the company (a legal entity) itself is a biologically living creature, which is the only thing capable of feeling*. To put a point on it: my lawnmower is also run by humans, but it does not have empathy for any grass or people that gets in its way. It mostly just goes where it is steered. A company is like that, except with less touching grass. * — unless you want to argue semantics about what "feeling" means, even though the discussion is about "feeling" and "empathy" in the way humans experience it, and how that form of "empathy" does not exist for a nonliving legal entity which may or may not employ any actual humans

r_lee 11d ago

> The front page post in HN here is worth far more than few thousand dollars , don’t think either organization is operating under purely financial transactional nature . not always, especially if its just someone independent. iirc there was a guy here not too long ago who started dropping Windows 0days because Microsoft couldn't be assed to process his bug reports

OkayPhysicist 11d ago
That actually supports the point that people aren't acting under purely financial motivations. If the guy was purely following financial motivations, surely he would have chosen to sell the vulnerabilities to the shadier side of things. Instead, he dumped them publicly, burning their value while amplifying the "fuck you" factor to Microsoft. Ignoring reports, or just fixing the vulnerability without acknowledging the work put in by a researcher, is rude and invites rudeness in return.
ivlad 11d ago
Microsoft runs a bug bounty program. NightmareEclipse (that’s the researcher’s handle) allegedly participated and Microsoft did not honor their part of the bug bounty program terms. This is a completely different situation - a company evaluates the security of a prospective vendor prior to entering a business agreement.
Aurornis 10d ago
> iirc there was a guy here not too long ago who started dropping Windows 0days because Microsoft couldn't be assed to process his bug reports Did that ever actually happen? I remember him threatening to start dropping 0days and getting a lot of press coverage for it. When I tried to look it up I didn’t find anything at the time.
- Barbing 10d ago
  > New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access https://bleepingcomputer.com/news/security/new-microsoft-defender-shieldcrash-zero-day-grants-system-access https://bleepingcomputer.com/news/security/new-microsoft-def... “Nightmare Eclipse released these zero-day exploits as part of an ongoing dispute with Microsoft over the company's bug bounty and vulnerability disclosure practices. […] Since April, the anonymous security researcher has disclosed a long list of zero-day flaws, including ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend, targeting Microsoft Defender, BitLocker, and other Windows components.”