Hacker News Reader

This concerns the bug bounty itself: Is there a Dropbox internal bug bounty program as well? As data is unencrypted, I assume the biggest thread to customer data are Dropbox employees.

View on HN

I don't know of any company that publicly advertises the bonuses they give (if any) to employees for finding vulnerabilities in their own software. That seems more like part of someone's job description.

Yeah the incentives get very murky very quickly there. One employee might ignore a vuln now so as to get a bounty for it later. A manager might give a known vuln-maker code access. Any group of employees might conspire to do either of those or something else at some remove. An actual attacker might manipulate any such conspiracy... It might be interesting as a study of Gambit Roulette, but not as any way to run a firm.

It's possible that GP meant giving independent researchers access to internal tools. That would be interesting but also very difficult to pull off safely.

Yes, but it would be even more important. Employees have access to system architecture details which makes it easier for them to harm users.

Reply on news.ycombinator.com