4 ms·

I don't mean to sound snide, but judging from your comment history on Telegram related posts, are you really the right person to determine what "reasonable effo

I don't mean to sound snide, but judging from your comment history on Telegram related posts, are you really the right person to determine what "reasonable effort" means in this context? Every single post you make is biased negatively towards Telegram. What I applaud is their effort here and I hope it continues and moves in the right direction. This announcement makes it seem like they are in fact moving in the right direction.

sillysaurus2 13y ago
This announcement makes it seem like they are in fact moving in the right direction. Why? Because they're literally paying people to like their product? This developer who found the bug wasn't even trying to get any money. He was, by his own admission, a cryptography newbie who happened to be looking over their protocol and found a serious bug. Now they're throwing money at him. How is that in any way a good thing?
- bhitov 13y ago
  >they're literally paying people to like their product I don't think this statement is reasonable. Are you suggesting that they gave the 100k reward out because they wanted the recipient to like their product? >Now they're throwing money at him. How is that in any way a good thing? I think bug bounty programs have a track record of efficacy. Do you disagree?
  - sillysaurus2 13y ago
    I meant they're giving out $100k because they want more people to like their product. If they cared about security more than getting users, then they wouldn't intentionally ignore advice from every crypto expert.
Nursie 13y ago
Their effort here seems mostly to have been PR. Their messaging system still uses a bunch of out of date and weird constructions. Sometimes negativity is not bias.
reginaldjcooper 13y ago
If you don't think "hire people that know what they are doing with crypto" is better advice than "have a contest that doesn't even prove security under known plaintext attacks and pay out $100k to someone who finds a MITM attack to prove you're serious", you're actually not qualified to determine who the right person to determine "reasonable effort" is. I know I sound like a complete jerk, but that's just the honest truth. The fact is that it is highly inappropriate to have a new, completely unvetted cryptographic protocol in a context where people are relying on it to provide actual security, and they are flat-out ignoring advice from talented and knowledgable people.

sillysaurus2 13y ago

This announcement makes it seem like they are in fact moving in the right direction. Why? Because they're literally paying people to like their product? This developer who found the bug wasn't even trying to get any money. He was, by his own admission, a cryptography newbie who happened to be looking over their protocol and found a serious bug. Now they're throwing money at him. How is that in any way a good thing?

bhitov 13y ago
>they're literally paying people to like their product I don't think this statement is reasonable. Are you suggesting that they gave the 100k reward out because they wanted the recipient to like their product? >Now they're throwing money at him. How is that in any way a good thing? I think bug bounty programs have a track record of efficacy. Do you disagree?
- sillysaurus2 13y ago
  I meant they're giving out $100k because they want more people to like their product. If they cared about security more than getting users, then they wouldn't intentionally ignore advice from every crypto expert.

Nursie 13y ago

Their effort here seems mostly to have been PR. Their messaging system still uses a bunch of out of date and weird constructions. Sometimes negativity is not bias.

reginaldjcooper 13y ago

If you don't think "hire people that know what they are doing with crypto" is better advice than "have a contest that doesn't even prove security under known plaintext attacks and pay out $100k to someone who finds a MITM attack to prove you're serious", you're actually not qualified to determine who the right person to determine "reasonable effort" is. I know I sound like a complete jerk, but that's just the honest truth. The fact is that it is highly inappropriate to have a new, completely unvetted cryptographic protocol in a context where people are relying on it to provide actual security, and they are flat-out ignoring advice from talented and knowledgable people.