Hacker News Reader

Comment by tptacek | Hacker News Reader

I don't really understand the point of making a big stink about Beg Bounty Hunters. They're invariably people in developing countries, for whom occasional SPF or Clickjacking payouts will be meaningful. And there's an unbounded supply of them. They're not going away. All you can control is the way you respond to them; lashing out at them in public seems like a pretty unhealthy response. Not for them; who cares? There's going to be 20 more right behind them. But I mean, just for your own sense of well-being.

View on HN

There are a few reasons.

1. The first is literally the first example of the article: real/important vulnerability disclosures get confused with beg bounties which dont need to be acted on / are not serious (most of the time). That can cause real harm.

2. The second reason is the approach that the beg bounty uses: that of fearmongering. If the beg-bountier disclosed the vuln and asked for the bounty that would be ok, but withholding the vuln until payment is assured is a scam.

3. How can one even properly valuate how much the vuln should be worth without knowing what it is / capable of doing?

> 1. The first is literally the first example of the article: real/important vulnerability disclosures get confused with beg bounties which dont need to be acted on / are not serious (most of the time). That can cause real harm.

I have a hard time sympathizing with this. Our project gets a handful of these "beg bounty" things a year; usually they're repeats -- SPF and "clickjacking" are common ones, but we also get other ones. ("You're exposing people's usernames through this weird JSON thing!" "Yes, we're also exposing people's usernames in the 'by' line of the post itself. There's nothing in that JSON that's not also available by just doing plain web scraping."). If we see a new complaint we always look at it to see if it's something we actually care about.

If you're working with pictures and audio of kids, or have details of people's activities that they may not want made public (like their taste in "Adult Fanfic"), there's absolutely no excuse for not looking at each report, even if 95% of them are low-value.

EDIT: I mean of course the "Report and then ask for a bounty" kinds, not the "Give me the bounty and I'll tell you the bug" kinds.

at $DAYJOB we get multiple beg bounties a week, it's a massive waste of everyone's time and it's literally never been a real issue.

At my previous job it was about 10 per days after we started having an official process. I gather that people would just Google us.

It was very easy to filter the bad reports, though. About 10 minutes of work per day, since most were repeated issues. We had a default "reply" email with information.

The issue however was those people would get extremely angry when their security issue was deemed invalid, so we started just blocking recipients that would threat us or demand payment for invalid issues. Some would stalk me and other developers in LinkedIn and would demand immediate payment. Of course that only happened about 4 times.

Another issue was caused when some invalid issues would get SO MANY REPORTS from automated scanners, that we would actually decide to change to prevent the reports. In some of those we actually paid and credited the first person, but then the other 30 would demand payment too and accuse us of lying.

Huge shitshow.

Complaining about the phenomenon isn't doing anything about any of these 3 issues. There is a powerful economic incentive driving it, and lot of independent actors. Really all we're doing here is driving up our own blood pressure. People who operate serious bounty programs have been dealing with this effectively for over a decade.

So other than feeding the Anxiety Industrial Complex, what do you propose?

My suggested approach is to not engage.

We've had a handful of these that we've paid out for small issues over the years.

Things that are _technically_ security issues, but not something that affect us or are exploitable in a meaningful way. $50 a few times a year is stupid cheap to build a reputation of actually paying out security researchers.

Among the junk, we've had a few legit bounties submitted. That alone is worth the noise these "beg bounties" create.

----

Security is a never ending game of cat and mouse. If you can pay out a small amount to people who might, just might, catch something all of your other processes miss, it's a pretty easy decision.

I run a bug bounty program and I don't mind report for small issues. It's true that most report from "beg bounty" hunters are noise, but we've acted on some reports a few time. One time, in particular, a researcher broke something which alerted us to a serious issue, while not understanding themselves what they had found, we still paid a fair bounty on the finding since we would not have found the issue without the action of the researcher.

It also helps that we have very clear rules and defined scope: we've put out of scope the usual suspects and researchers rarely argue when we point out they should have read the rules better before submitting.

Regarding bounties, my yardstick rule is that if a report made us reconsider our practices and change something on our side, then it's worth a bounty, even small. If not, then no bounty far ya, simple as that.

Also, I don't remember getting a disclosure report where they would ask for money before disclosing the vulnerability, I don't think it's that common. Still, this would go straight to the spam folder.

In my experience paying out once to a bug hunter resulted in an avalanche of useless "beg hunter" reports in the following weeks. Understandably security researchers brag about their finds on their resume but that has the side effect that other guys apparently crawl those and start targeting you.

I'm not saying this is good or bad, but just a warning that you should be prepared to read a lot more reports once you start paying.

The flip side is we've had some very serious, legit security researchers test our application as a result of our reputation for paying out bounties.

How many of the legit bounties have been withheld until you paid?

None. We don't pay if the bounty isn't verifiable. This is the standard for the industry.

This is part of the reason paying out small bounties is valuable and important. You want to build a reputation in the community for honoring your responsible disclosure policy.

“But I already washed your window while sitting at the stop light”

It’s one thing to go begging, it’s another when they feel entitled to some sort of payout. I never asked for their “services” - and in my limited experience, they lash out at you too, when you explain you’re not paying.

My parents lived in New York City during the early 1970s, a time of serious decay. The "free" car window washers was a thing. You would stop in traffic (Manhattan) usually, then someone would start to clean your front window with a dirty squeegee, then come to your driver side window and ask for a tip (payment).

By the time it started showing up in 1980s comedy films, it was mostly gone in real life. I am surprised to see an Ozzie referring to this. Or is he referring to something tlese?

He's referring to car window washers at traffic lights.

Maybe in Australia which has had them at various location in capital cities in the 80s, 90s, 10s by my recall. Maybe in other countries as while Troy is Australian he's moved about a bit ... but probably Sydney - it's one of those modern clean yet dirty cities with a bit of everything.

EDIT: The quote doesn't come from Troy, it's sourced from a twitter reply he received from "John" @j3g

FWIW, it was pretty common in Vancouver, BC when I lived there in the late 90s.

And? You're not accomplishing anything by pushing back on them.

I simply said “thank you for the report but I’m not paying”. The “researcher” responded by spamming the rest of the board and the property manager for the community with hundreds of messages filled with expletives.

I didn’t write a blog or do anything to “trigger” anyone. Heck the only reason I replied is because they kept emailing the other non tech people in an attempt to extort money out of them.

I don’t find their behavior excusable and have no problem calling them out.

The trigger is any form of response. Just let it pass.

Meaningful or not, some companies and organizations don't understand the difference between a CVSS score of 2.0 and 10.0. Being in the cybersecurity industry myself, there is a wide gap of knowledge in the risk of vulnerabilities. Following a some-what standard way of reporting vulnerabilities is well documented. Begging for a bounty is not standard.

I also think that is perfectly fine to document the process in public so that everyone is informed.

Also, in regards to your comment on meaningful payouts, you could make the same argument for spam email. Occasionally it works for people in developing countries is, in my opinion, a terrible argument for allowing such behavior.

> Occasionally it works for people in developing countries is, in my opinion, a terrible argument for allowing such behavior.

I think the point GP was raising isn't that it's ok, but that it's part of a wider problem and isn't just happening because people are stupid. It makes sense for them because of how the world economy is currently set up. Saying "hey will you just stop please" won't change that fact. Exactly the same thing is true for spam.

Bad behaviour should not be tolerated just because it comes from the third world

Not tolerated but it should be understood. Lots of developers would do morally dubious things for a 'life-changing' amount of money. If you live in a very poor country that isn't a large sum compared to a Western salary.

It’s not hypothetical. Lots of developers do do morally dubious things in the west for large amounts of money!

I mean, I work at Amazon

Understood to be more efficiently dealt with, yes.

You don't have the option of tolerating or not tolerating it. You're seeing one of these people, but there are a thousand more behind them, and they don't care what you tolerate or don't; it's a numbers game to them.

I think there's plenty of established ways to deal with the general category of "spam" and these can be applied to this problem equally well.

I get what you're saying about it being unavoidable, but there's no need to concede without a fight.

I think the article made the argument that beg bounties drown out and train receivers to ignore better more fundamental reports as also being spam.

I've received those mails a few times and while I agree with you to some extent, the way they are often formulated feels closer to "nice store you have here, shame if something were to happen to it!" -- as in, what is this person going to do if I don't pay up? That does not seem ethical to me.

That's one of the reasons that I don't play with scammers, anymore.

Most of them live fairly miserable lives of poverty.

That doesn't excuse them, but I don't feel it does me any good, to pile further misery on them, when it's just easier to walk away.

The problem is that they do have real consequences for others. It is a kind of zero sum game where their gains come from the loss of others. I have no sympathy for them.

If you want to help them, why not just send them $$?

I don’t want to help them.

Not wanting to hurt people deliberately, is not the same thing as wanting to help them, or supporting them.

When we engage in retaliatory behavior, it can have negative consequences on our own psyche. This is something I know well.

>to pile further misery on them

Usually the goal is to keep them away from real victims, to prevent further misery of more people.

See my reply below.

I have found that deliberately hurting others; regardless of whether or not they deserve it, tends to be corrosive to my mental well-being.

Another thought on this, coming from someone whose phone number has ended up on some large number of scammer lists, to the point where I would have about 1000 scam calls per month around open enrollment time (think targeting seniors):

You are advocating for feeding the troll. The troll will not be satisfied with table scraps. Larger trolls will see the opportunity and scale up.

I get what you’re saying. I don’t have a solution to the inequality you point out. But rewarding the bad behavior doesn’t help rectify the inequality, it just makes more bad behavior.

Whoah, I am definitely mot telling you to pay these people.

This is extortion, and a crime.

Good luck with that.

Good luck with what?

Reply on news.ycombinator.com