4 ms·

Bug bounty programs seem to be more and more necessary for a mature security program. I feel like this can span the gamut from resources for responsible disclo

Bug bounty programs seem to be more and more necessary for a mature security program. I feel like this can span the gamut from resources for responsible disclosure all the way to robust bug bounty programs that offer pay outs. The barrier to entry for the former should be low and something that every organization with security personnel can arguably support, but once you start doing pay outs, the need to run a tight ship in regards to how bugs are evaluated becomes far greater.

Someone1234 12y ago
Yeah, it seems like a welcome evolution. Back in the old days far too many companies had very poor processes for dealing with security issues. Either it was impossible to give the report (stuck in CS hell), you'd never hear feedback (e.g. fixed, WONTFIX, etc), you may be threatened with criminal/civil prosecution, and you most certainly wouldn't be credited or acknowledged. Now, if nothing else, at least the process is well documented end-to-end. Even if we ignore the "debate" over compensation, at least all the other problems are now solved. If you throw on top of that a small "thanks" payment for finding the bug, you now not only solve the old problems but you give people a legitimate reason for responsible disclosure beyond morals. That's really the core of this, doing the right thing should make rational sense as well as moral sense. Then the bug finder has no real reason to do anything except the right thing. The only reason not to disclose responsibly now is spite (or in Google's case a strict adherence to policy no matter how little sense it makes).
- nulltype 12y ago
  Unless someone makes a bug bounty program for Dropbox bugs that offers more than Dropbox does. I don't know what the fair market rate for these bugs are, but it could well be higher than what Dropbox is offering.
SamHoustonCM 12y ago
Yeah,running a public program and are handling a lot of submissions (pretty typical), handling the volume of bugs and evaluating them quickly can be quite tricky. Not only is it important for the company because you want to make sure you're aware of what's out there, but you also want to make sure the security researchers have a great experience.

Someone1234 12y ago

Yeah, it seems like a welcome evolution. Back in the old days far too many companies had very poor processes for dealing with security issues. Either it was impossible to give the report (stuck in CS hell), you'd never hear feedback (e.g. fixed, WONTFIX, etc), you may be threatened with criminal/civil prosecution, and you most certainly wouldn't be credited or acknowledged. Now, if nothing else, at least the process is well documented end-to-end. Even if we ignore the "debate" over compensation, at least all the other problems are now solved. If you throw on top of that a small "thanks" payment for finding the bug, you now not only solve the old problems but you give people a legitimate reason for responsible disclosure beyond morals. That's really the core of this, doing the right thing should make rational sense as well as moral sense. Then the bug finder has no real reason to do anything except the right thing. The only reason not to disclose responsibly now is spite (or in Google's case a strict adherence to policy no matter how little sense it makes).

nulltype 12y ago
Unless someone makes a bug bounty program for Dropbox bugs that offers more than Dropbox does. I don't know what the fair market rate for these bugs are, but it could well be higher than what Dropbox is offering.

SamHoustonCM 12y ago

Yeah,running a public program and are handling a lot of submissions (pretty typical), handling the volume of bugs and evaluating them quickly can be quite tricky. Not only is it important for the company because you want to make sure you're aware of what's out there, but you also want to make sure the security researchers have a great experience.