4 ms·

Excruciating evidence that supports Moxie's position. Vuln rewards should exist for two purposes: 1)An act of good faith on the part of the developer that say

Excruciating evidence that supports Moxie's position. Vuln rewards should exist for two purposes: 1)An act of good faith on the part of the developer that says "I am interested in securing my product and I won't prosecute direct disclosure" 2) The Dev knows exploitable vuln discovery has value, but cannot compete with black market pricing. Instead, the reward is a token of appreciation for a shared code of ethics. I wish bug bounties could compete with the budgets of nation states. They can't. Companies shouldn't pretend to compete. Shame on telegram for stupidly false promises.

danabramov 13y ago
I have no idea what you are trying to say here. The guy is rewarded half the bounty: https://vk.com/wall-52630202_7858 https://vk.com/wall-52630202_7858
- droopybuns 13y ago
  Vuln reward programs that payout at this level are broken. 1) They don't achieve their objective of securing a product. Moxie eloquently captured why here: http://thoughtcrime.org/blog/telegram-crypto-challenge/ http://thoughtcrime.org/blog/telegram-crypto-challenge/ 2) At this level of payout, they are inefficient and unsustainable. There were less expensive ways to discover implementation flaws, and certainly more direct ways to discover design flaws. Was the lesson they just learned really worth $100 grand from some random dude on the Internet? Seems to me you could find more problems per dollar by directly engaging with some of the top class security consultancies out there. So to summarize, telegram's reward was an extremely inefficient stunt that did not achieve it's likely real objective. I imagine the team is licking it's wounds right now and regretting their approach. We'll be able to tell by whether or not they continue their offer under the same rules and same budget. I expect this to continue for another couple of rounds because random security people on the Internet will be smelling blood right now.

danabramov 13y ago

I have no idea what you are trying to say here. The guy is rewarded half the bounty: https://vk.com/wall-52630202_7858 https://vk.com/wall-52630202_7858

droopybuns 13y ago
Vuln reward programs that payout at this level are broken. 1) They don't achieve their objective of securing a product. Moxie eloquently captured why here: http://thoughtcrime.org/blog/telegram-crypto-challenge/ http://thoughtcrime.org/blog/telegram-crypto-challenge/ 2) At this level of payout, they are inefficient and unsustainable. There were less expensive ways to discover implementation flaws, and certainly more direct ways to discover design flaws. Was the lesson they just learned really worth $100 grand from some random dude on the Internet? Seems to me you could find more problems per dollar by directly engaging with some of the top class security consultancies out there. So to summarize, telegram's reward was an extremely inefficient stunt that did not achieve it's likely real objective. I imagine the team is licking it's wounds right now and regretting their approach. We'll be able to tell by whether or not they continue their offer under the same rules and same budget. I expect this to continue for another couple of rounds because random security people on the Internet will be smelling blood right now.