Hacker News Reader

Comment by busterarm | Hacker News Reader

My opinion, not my (HackerOne customer) employer's:

I know this will be unpopular with folks like tptacek, but I've always felt strongly that bug bounty programs offer too many perverse incentives to all parties.

More often than not it becomes a tool for companies to sweep issues like this under the rug and then use HackerOne's system to force the reporters to play ball (because they want to keep getting paid). I hate this sytem.

I'm 100% behind open, public disclosure and if it were my own product in question, I would offer bounties for _public disclosures_. That keeps everyone honest.

View on HN

I agree with you from the other side. Before these programs people would disclose issues to the public. The company found out like everyone else. They would fix it immediately because they had to.

Now they can hide it for months(ever) allowing others to discover them and keeping the researchers quiet.

A normal process goes like this:

- Researcher finds bug

- Researcher discloses to vendor

- Vendor fixes (or not)

- Researcher discloses bug publically once vendor has fixed, or after X time (whichever is first)

This is roughly how Project Zero goes, and it's a good mix between giving the vendor the opportinity to fix it and deploy the update before it gets exploited.

It's very naive to assume that bugs can be fixed before others can exploit them. Bugs take time to fix, and the process takes time, especially when dealing with large enterprises.

Why is it whichever is first and not after a fixed time? I see a benefit to waiting X time regardless, because it allows more time for the patch to circulate to everyone. What is the benefit to disclosing it immediately after it is "fixed"?

It's generally not possible to release a fix without effectively disclosing the vulnerability. It's just too easy for people to deduce what the vulnerability was by looking at the patch.

The vulnerability can often be discerned from the patch. Burying it amidst lots of unrelated bogus changes and not calling out its security relevance is going to annoy your users.

It's typically not immediately after it's fixed, but usally about a week or so, to let the majority update.

The vendor can also usually request an extension, as per the Project Zero guidelines, of I believe 1 month if they confirm to be actively working on a patch.

The goal of responsible disclosure is to help the vendor and their users' be more secure, so having a policy that is balence between the two is important to let the vendor fix it, and to not let the users be possibly hacked

Couldn't the researcher have just sold his finding to Project Zero?

If so, that seems like a superior alternative to immediate public disclosure.

Reply on news.ycombinator.com