3 ms·
Am I missing something, or did you describe every bug bounty program everywhere? Isn't this exactly the definition of a security bug? Even in your dry analogy,
by nothrabannosir 11y ago
Am I missing something, or did you describe every bug bounty program everywhere? Isn't this exactly the definition of a security bug?
Even in your dry analogy, what's the problem? Would you not want people to tell you they found a very easy way to take money out of the register?
Not that it matters; this is text-book, industry standard security bug reporting. He waited with the public disclosure until it was fixed.
(If he didn't; different story. Maybe I misunderstood that part? Was that it?)
- titanomachy 11y ago> After trying really hard to find anyone who cares, I managed to get this bug fixed in like 10 days. Sounds like it did get fixed, but it was a little confusing because he goes on to talk about how he could make millions counterfeiting gift cards.
- intrasight 11y agoIndeed. The author and the article lost what little credibility that existed at that point.
- TheCowboy 11y agoHow did he have little credibility? And how did he lose it? He spent his own time helping Starbucks improve their security. Starbucks insinuates or suggests he committed fraud and malicious actions for finding AND trying to alert them of the problem so that it could be fixed. Starbucks was out of line here, not him. While not eloquently expressed, it should still be obvious to most readers of this site that he is not implying that next time he will go and steal millions when he finds a bug. He is articulating that corporations that respond this way create a culture where they will only find out about vulnerabilities when it's too late, because no one will want anything to do with them. If anything, the more serious bug is the attitude of Starbucks as an institution here, and people not holding Starbucks accountable.