I hacked the Dutch government and all I got was this t-shirt
jacobriggs.io
jacobriggs.io
Fairly big controversy in Norway. Bergen (the municipality) showed incredibly bad faith and the worst possible judgement. "Datatilsynet" (Norwegian Data Protection Authority) gave them a decent fine, and Bergen showed no humility, opted to dispute the fine as if the fact that a kid finding everyone's usernames and passwords was something that was a daily occurrence with no more significance than spilling coffee on one's shirt.
https://www.nrk.no/vestland/datatilsynet-star-fast-pa-millio...
> BORIS: The Chief of Computers will call me a genius, move me to Moscow, and give me a million bucks hard currency..... I think not.
While they absolutely could / should have rewarded him with more than a lousy t-shirt. I suspect they aren't keen to encourage a bunch of random people to try and poke holes in their security with the expectation of a cash price.
You can either reward your own citizens with large cash prizes, OR, you can reward Russia/China with your data since they'll gladly poke around for free.
This is being penny wise and pound foolish.
Most humans also need a full-time job to survive. If I wouldn't have to work a job to live, I would have more free time for good Samaritan pen-testing for the government if that would pay my bills instead.
In some socialist European countries, artists get subsidized by the state to create "art" instead of working. Why can't we do that with pen-testers? Sit around at home on UBI and look for zero-days in government infrastructure?
(BTW, maybe check on the origin of "Good Samaritan". His saintly disinterest in any sort of personal gain was the whole point of that story.)
The t-shirt is actually kinda nice in that regard. Of course, it would go better with stuffed euros.
Imagine a meeting where some bureaucrat went to their boss and said "hey this person did us a huge favor, can I get a €30 budget to specially order them a gimmick t-shirt" followed by some correspondence where the government obtained their address and shirt size, yet bizarrely not their name. I can't believe that happened.
Also, it's unlikely that they didn't just ask for the author's size and address. The standard disclosure process involves a temporary non-disclosure and negotiating if/when publication of the issue will take place.
The author was pleased with the response, and the process has improved since this was published.
You could look at it the opposite way around - someone's come up with a genius idea to do a bug bounty on a beer budget.
[0] https://english.ncsc.nl/latest/weblog/weblog/2022/i-am-on-th...
A team of government workers spending paid time deciding which security volunteer deserves the most nonfinancial recognition mildly irks me.
There's also more to the process than just sending a shirt.
> * If you submit your report in accordance with the procedure, then there will be no grounds for legal consequences in relation to your report. We will handle your report in confidence and we will not share your personal details with third parties without your permission unless we are compelled to do so by law or by a court ruling.
> * We will only specify your name as the discoverer of the vulnerability in question if you give permission for us to do so.
> * We will confirm receipt of the report within one working day and we will subsequently send an assessment of your report within three working days. We will also give you progress updates regarding the resolution of the problem.
> * The NCSC will strive to have the the security problem identified by you resolved within no more than 60 days. Upon resolution of the problem, we will consult with you to determine whether and in what way to publish details of the problem and its resolution.
> * The NCSC will also offer a reward to thank you for your help. This reward can vary from a T-shirt to gift certificates depending on the severity of the security problem and the quality of the report. To be eligible for a reward, the report must concern a serious security problem that is as yet unknown to the NCSC.