Hacker News Reader

Comment by marcinzm | Hacker News Reader

>Moreover, they didn't want me to disclose the vulnerability. At the same time, there was not even a single word from Valve. No, guys, that's not how it works. You didn’t respect my work, and that's the reason why I won’t respect yours — I see no reason why I shouldn't publish this report. Most likely I’ll be banned at H1 because of it, but it won't make me upset.

This seems pretty scammy of HackerOne and does nothing but hurt security. Either something is an issue and should be paid for, or it's not an issue and disclosure is fine. They're trying to have it both ways and trying to strong arm researchers into keeping quiet.

View on HN

I've mentioned before how disappointed I've been to watch hackerone move from a platform helping responsible disclosure to a platform helping companies hide vulnerabilities.

It used to be that even accepted bugs and paid bounties would be publically disclosed. It helped me learn a ton just from reading the (partially redacted) bug reports. Over time they became more and more redacted until they were left entirely pointless.

To mark a bug as N/A, declare it 'not fix' but then say also it can't be disclosed is precisely why responsible disclosure is a thing. Companies can't have their cake and eat it.

This is why “responsible disclosure” has been rejected as a term among security professionals for many years now. Vendors invented it for self-serving reasons.

https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coor...

What are the alternatives for HackerOne for hosting a bug bounty program? My company is looking to set one up and H1 was way too expensive and tried to push all their extra features.

All we want is a place to host a bug bounty page and allow us to pay rewards through it. The only reason I'd prefer hosting that on a platform rather than just making a bug bounty page on our own site is that I feel bounty hunters would trust it more, since it's not just some random page on a company website they've never heard of before.

I think there's a fair question to ask here: is HackerOne a bug bounty program that offers security consulting services, or a security consulting service that's implemented as crowdsourced bug bounties? If I hire a normal security consultant, and she finds an issue in my product that I don't agree is a real vulnerability, it's absolutely not fine for her to go write a public article about it.

>If I hire a normal security consultant, and she finds an issue in my product that I don't agree is a real vulnerability, it's absolutely not fine for her to go write a public article about it.

The difference is that you pay her either way. HackerOne doesn't. If HackerOne wants the advantages of paid employees then they need to pay for employees and not mask it as a bug bounty program.

> and she finds an issue in my product that I don't agree is a real vulnerability

If it’s not a real vulnerability then why would it matter if she publicised it?

Or, is it actually a real vulnerability but you don’t want to admit it because she (the security consultant) is getting paid per vulnerability found?

Because most people can't and don't critically evaluate vulnerability reports. If "SpicyLemonZest Windows Client Local Privilege Escalation 0day" becomes a trending headline, my customers will demand I do something about it, even if I have a perfect explanation for why it's not a real vulnerability and they're at no risk.

Serious question: why?

Unless the company is lying and it IS a real vulnerability, writing an article about it seems harmless to me.

OFC that if I planned on writing an article I'd be open about it beforehand, but that feels like a courtesy and not an obligation unless an NDA is involved.

Disclaimer: I don't work in security so this is purely curiosity.

It'd be like writing public articles attacking your company's accounting practices. Sometimes things are so bad it's fair to blow the whistle, but it creates nasty incentives if companies can't perform private security investigations without risking a public shaming over the results.

These people are not employees. They don't agree to amounts before starting the work. They don't make promises. Nothing! I don't see how someone publishing something in that situation is a problem.

Like OP wrote in this thread, it either is a vulnerability or it's not. In the latter case, just assume it's the cost of doing business and people will write "bad" things about your product?

An NDA is always involved. And even if not, badmouthing your customers is bad business.

Are they really customers?

If we're talking about normal security consultants and not h1, yes?

HackerOne is a platform on which Valve runs a public program [1] that awards monetary bounties. I'm confused as to why Valve is allowed to forbid disclosure of "out-of-scope" reports and will only "generally" disclose reports in any case:

> Please note that we will not consent to disclose reports if they have been marked out-of-scope or inapplicable, or where Valve has not taken a specific corrective action / mitigation.

> Valve embraces transparency in our security. We will generally disclose the details of vulnerabilities found, upon request.

[1] https://hackerone.com/valve

I think a lot of users of your platform would disagree. Publishing attacks like this and getting them noticed helps prevent targeted attacks.

Reply on news.ycombinator.com