Hacker News Reader

Comment by StavrosK | Hacker News Reader

If you find that someone forgot their car door open, do you deserve money for not telling thieves where you can find a car with an open door?

Bug bounties are a good incentive for hardening your security, but is exploiting flaws the moral thing to do by default? Does there need to be a monetary incentive for people to do the right thing?

I run a service that has a few users and makes about $200/mo. Someone once emailed me that they found a bug and whether I run a bug bounty program. I told them I couldn't really afford one and they never replied. Are they now morally justified to publicize the flaw?

View on HN

Your analogy has cause and effect reversed. The correct analogy is that if I know there is a reward for telling people their car doors are open, I will go around town specifically looking for open car doors. With no reward, I'm just going to go about my life not even looking at car doors.

Your service may be too small for this, but a company like Amazon typically saves money overall by running a bug bounty program because uncaught bugs can be extremely expensive.

The GP said "the next time someone finds a bug", ie the assumption is that a bug has been found. They didn't talk about whether bugs would be found or not.

Selling zero day exploits is an amoral act.

That being said, your analogy is broken and doesn't fit here at all. First, parking lots are passive and have no intelligence. Amazon is neither of those things. Also, there are no such people who dedicate their career to lawfully testing the security of parking lots in exchange for money.

In the real world of mega corporation technology (which is almost as different from a parking lot as you can get) there are countless black hats motivated by money to steal from Amazon, and countless grey hats who would help combat or mitigate the issues if properly compensated. White hats are the rare exception and report issues even without compensation.

There are numerous grey hats who: 1) If there is a bug bounty program, would report the issue to be fixed 2) else, would ignore the issue entirely.

You know this is true because you experienced it yourself. The difference is you can't afford the service of a grey hat.

So forget the morality of these hackers.

Amazon refusing to pay out a bug bounty program is amoral. Because what you're seeing is Amazon trading the security of their customers, and for what? Greed and hubris it seems.

> their car door open,

Not at all similar. One is leaving open the door to your own car. The other is someone who is being entrusted with keeping something safe for third parties "leaving the door open", i.e. being in breach of that trust, and essentially saying that they don't give a frack about their infraction.

So how can Amazon be sanctioned for this infraction?

While I also don't see "breaking in" as necessarily a great option, it may be less bad than letting Amazon just get away with it. Unless there is a good way to fine or otherwise sanction Amazon, I am not sure there is an actual good option.

You can't afford aa bug bounty program. Amazon can.

Does that make it moral for someone to disclose the bug? "This parking lot leaves cars unlocked, but since they seem busy and aren't paying me not to, it's okay if I tell thieves about it".

Telling thieves in particular? Absolutely not.

Telling everyone (unfortunately including thieves)? I think it is. Such negligence should be disclosed.

>If you find that someone forgot their car door open, do you deserve money for not telling thieves where you can find a car with an open door?

Conversely, if you accuse the person who tells you the door is open of stealing from you and threaten to call the police, should you really be surprised if next time that happens they tell someone, maybe in exchange for a cut of the profit?

Reply on news.ycombinator.com