Comment by mtlynch | Hacker News Reader

Comment by mtlynch | Hacker News Reader

Parent Full thread

>The Avelo team was responsive, professional, and took the findings seriously throughout the disclosure process. They acknowledged the severity, worked quickly to remediate the issues, and maintained clear communication. This is a model example of how organizations should handle security disclosures.

Sounds like no bug bounty?

It's great if OP is happy with the outcome, but it's so infuriating that companies are allowed to leak everyone's data with zero accountability and rely on the kindness of security researchers to do free work to notify them.

I wish there was a law that assigned a dollar value to different types of PII leaks and fined the organization that amount with some percentage going to the whistleblower. So a security researcher could approach a vendor and say, "Hi! I discovered vulnerabilities in your system that would result in a $500k fine for you. For $400k, I'll disclose it to you privately, or you can turn me down and I'll receive $250k from your fines."

> I wish there was a law that assigned a dollar value to different types of PII leaks

There is. It is called GDPR.

Plenty of companies have been fined for leaks like this.

Some countries also have whistleblower bounties but, as you might expect, there are some perverse incentives there.

Yeah, as an American, I'm jealous of many aspects of GDPR. I really appreciate you blogging / tooting about experiences protecting your rights under GDPR. I wish we had 1/10th of the consumer privacy protections you have.

How does security research like this work out in practice, in the EU?

I read a lot of vulnerability writeups like this and don't recall seeing any where the author is European and gets a better outcome. Are security researchers actually compensated for this type of work in the EU?

The GDPR (in art 32) only requires that "the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk". I expect it's quite common for a company to get hacked even if they meet that level. I think the parent comment was imagining that any leak is automatically fined, regardless of whether the company had met some security requirement.

Does GDPR mandate a payout to the researcher after disclosure?

The GPDR makes it so small companies need to hire expensive lawyers to be compliant (and you still don't know for sure, based on the laws)

How about fining individual developers with poor coding practices?

No it actually doesn't. It just needs someone in the company executive to not have their head up their ass, and read the law, which is fairly straightforward.

Also, it needs your company's business model to not be selling user data. That's why American companies find it hard to comply with.

It does not mean this.

> it's so infuriating that companies are allowed to leak everyone's data with zero accountability and rely on the kindness of security researchers to do free work to notify them.

This is a matter for lawmakers and law enforcement. Campaign for it. Nothing will change otherwise

Reply on news.ycombinator.com