4 ms·
Self service security bounties seems like a very smart idea. Would self-service security bounties enable a distributed bounty ? where each site developer puts
by minthd 11y ago
Self service security bounties seems like a very smart idea.
Would self-service security bounties enable a distributed bounty ? where each site developer puts a relatively small bounty in his site and his bounty offers him a certain qualification in the eyes of customers , but from the hacker standpoint , if you hacked one , you hacked them all and hence you can collect multiple bounties ?
- amirmc 11y agoIsn't that pretty much what we have already with things like openSSL? Find an exploit and suddenly you've exposed everyone. I don't think public bounties would change any of the dynamics around this situation.
- minthd 11y agoWith the current system, if you're using an exploit(especially for gain), you're a criminal.Not so when using pinata. Also , pinata exposes all hacks in public, unlike today.
- amirmc 11y agoMy point is that I don't believe any of the dynamics would actually change. White hats would still report issues (they're not necessarily doing it for the money) and nefarious types will still trade/sell exploits.