4 ms·
Most bug bounties encourage responsible disclosure, which was not done in the original blogpost. With that said, it's kind of a grey area. Some may reward you
by theboss 13y ago
Most bug bounties encourage responsible disclosure, which was not done in the original blogpost.
With that said, it's kind of a grey area. Some may reward you but others may not. Google for example asks for responsible disclosure. They will most likely be reluctant to give you a reward if you didn't play by the rules and undermine the entire purpose of the vulnerability reward program anyways.
The program's aren't meant to show off how smart the engineers are who work there. The programs are meant to prevent legitimate attacks. No news is good news in the security world...and you don't know that you made the news until too late.
I should add, when reporting the bug, I know google asks if the bug is made public and they also ask for a URL to where it is available. So maybe the area is more grey than I think. Nobody will know until someone reports a public bug, I guess.
- Xylakant 13y ago> Most bug bounties encourage responsible disclosure, which was not done in the original blogpost. The original blog post basically summed up and condensed that everybody who knows about HTML could have seen. I didn't even blink in surprise when I saw it. It was well executed and written and as such a worthy contribution but the attack vector was rather obvious. Pretty much my first thought when I saw what LinkedIn is doing was "There's certainly a way to abuse this and inject false info.". AFAIR similar feelings were voiced in the HN thread about the original submission. I'm all for responsible disclosure, but in this case I don't think it was warranted.
- surreal 13y agoSeveral others might agree with you, but the fact remains LinkedIn security missed (or ignored) a legitimate issue and released the new feature. Surely that should define whether a reward is justified