Hacker News Reader

Comment by Shank | Hacker News Reader

> To the companies: You don’t need HackerOne anymore. The tokens to build your own in-house platform cost less than single year of HackerOne.

You know, the biggest thing that HackerOne delivers is a universal payments system that requires absolutely no efforts from companies. Have you tried to manually pay hackers from around the world? It is a laborious process involving trying to find what providers are compatible and what forms of money go where. It is extremely taxing to handle this. HackerOne provides real, tangible value in not making people think about how precisely to pay a hacker and in what currency. No amount of tokens solve the accounting problem, and it is foolish to imply otherwise.

View on HN

This is a great example of a general trend, which is why I don't think SaaS is going anywhere. The bar may be raised, but it's not going anywhere. HackerOne and SaaS in general makes problems go away for money. If you use your own tokens and solve it yourself, it's still your problem. The deficiencies are your problem. The support and ongoing maintenance are your problem. Discovering some country split in two and now has to have currency handled in some other way is still your problem. And they never end.

I see some people with the idea that businesses are going to use AI to solve everything in their own one-off bespoke manners for everything, but I don't think it's going to happen. What's going to happen is that the SaaS providers are going to get even better at making yet more stuff go away than they were before and it'll actually be harder for a business to replicate it themselves then it used to be.

(Of course the "go away" isn't perfect, but clearly, neither is the idea that solving everything yourself with AI is either.)

> If you use your own tokens and solve it yourself, it's still your problem.

The flip side, of course, is that I can fix my problem - which may be unique and not something a large SaaS will ever do - on my timeline.

That's not a new flip side, though. That's always been with us. SaaS will be more able to take on more requirements then they used to be but no one SaaS will ever be able to take on everything. And the decision between "roll our own and own it forever versus buy this one service that almost does everything we need, but not quite, but maybe it's worth living with it because it's still better than rolling it ourselves" isn't going anywhere either.

I would not want to be a SaaS that offers some really simple service that can be replicated in a heartbeat, though. Something like "how do I pay people all over the world" is already very complicated, and over the next decades as governments start writing laws with the understanding that AIs can implement them in code no matter how complicated they are, it's likely these problems will become even more complicated and even more important to just buy a service that can deal with them. (I'm not celebrating that, merely predicting it.) But I sure wouldn't want to be selling some super simple scheduled reminder service or something else really small.

In the worst case, envision a world where home owner associations or townships or whatever other local governmental division of just perhaps a few hundred people start levying sales taxes, with their own complicated exclusions and offsets and conditions, because LLMs make it possible to handle the code for all of the literally hundreds of thousands or millions of such jurisdictions. Even if you can throw tokens at that problem to solve it yourself, you probably don't want to. And again... I'm not celebrating that. More a world-weary bowing to the inevitable despite it being an obviously bad idea.

> That's always been with us.

But the ability to meaningfully make a personal implementation has changed.

I think there is a chance that this changes.

I think there might be space for "source available" enterprise software where you can use an LLM to modify it in a way that is cheap to continue reintegrating in new releases.

It may also be reasonable to send your prompts to the vendor and see if it is a feature they are willing to maintain.

> This is a great example of a general trend, which is why I don't think SaaS is going anywhere.

One learning I can share from the indie game industry is copycats become dime a dozen when a particular game becomes successful. With execution becoming nearly cheap, tasty products and their behaviour will be copied and competition will rise substantially.

Are there many copycats that are meaningfully impacting the revenue of games?

You can argue that games are derivative, but I think most revenue still goes to premier titles, not knock offs.

I feel like there's this assumption that some people picked up a few months back and never examined, that the big guys were going to keep plodding along with the same old methodologies and the little nimble guys with AI might be able to nimbly out play them.

But the simple truth is 100 programmers with AI are going to do a lot more work than 1 or 2 programmers with AI. All the usual considerations for communication overhead and all the old reasons why 100 programmers aren't necessarily 100 times as productive as 1 are in play... but so are all the reasons why that group of 100 programmers is going to outdo that 1 no matter how hard that 1 works.

We are probably in roughly the middle phase of the time period when we're still learning to harness AIs at all, and seeing simply some modest accelerations of process. Eventually we're going to progress to getting significantly enhanced productivity from them for pretty much everybody. And then what will happen is not that the SaaS market crashes, but what constitutes an entry-level SaaS product will rise up to meet the increased programming firepower. Find me a SaaS whose current two-year roadmap is "Eh, don't do anything, really, we're set" and I'll show you the SaaS company who probably ought to be really, really worried about AI eliminating their entire niche. I'm sure there are some out there, but it's not the usual SaaS company experience.

Teams is exactly that. I think in this modern age of AI, Distribution is the main winner everywhere.

> universal payments system that requires absolutely no efforts from companies.

Indeed. I use a third party company (not HackerOne) to handle our bug bounty and the primary reason is so they handle all the payment hassles, I don't need to be involved. They also handle all the screening for false positives, which in the AI age are exploding. I also don't want to deal with that.

In general I lean towards building in-house, but this is one area I'm happy to oursource all the busywork.

Mind sharing which company you use for this?

There are many options, probably mostly equivalent, just depends where you can negotiate a price agreeable to your budget.

But to answer the question, currently using Inspectiv.

This and the pre-triage are the only reasons we even use a bug bounty platform.

If paying out bounties was easy I would do it all via email; but as you said it’s almost impossible to do (unless you are maybe bigcorp and have a team just for that)

I worked at a big corp and we paid out randoms for a program (not bug bounty). It was an absolute minefield, people would lie to us about where they were located only for us to find out they’re in <insert sanctioned country here> and then legal tells us we have to pay them but we’re not allowed to at the same time.

Outsourcing all that mess is a great use of money.

Yea we also handled it ourselves the first couple years but it was so painful. Literally the same thing you described happened - as well spending weeks+ how we need to file it as tax when we pay bounty to someone in Pakistan etc.

Are you in the US? You simply collect a W8 from them that you keep on file and then the payment would be counted as an expense on taxes. We do payout to hundreds o f affiliates every year and this is how we handle it, it's really not complicated. The actual payments are done via Wise batch payments which just requires their email address.

My largest problem with H1 is how braindead scripted/AI their triage is.

- Starting scenario: no way to contact a company outside of H1 (or some other managed programme)

- The company is compromised, their customer support has no idea what this means, they have no security.txt or any other security contact

- I have explicitly told H1 to just forward it with no bounty, I don't want a bounty, only remediation, I do not care about a bounty or any reward

- H1 closes as "not eligible" and tells me to not submit stuff I can't prove it's my compromise by putting my username on it

- Corporate server is still compromised and being used as a proxy to brute force my services

If a company's server is attacking yours, I'd go to legal@company.com before I go to H1.

Yep, spot on - this and some level of inbound filtering are the only reason we use an external platform.

That said, with the volume of inbound reports coming from LLMs, the signal-to-noise ratio has plummeted, and the time taken to triage has gone through the roof.

This is, in general, a good statement of a durable problem one can 'solve' profitably. Basically take a problem that is hard to do 1:1, systemize it such that you can easily tune the solution to "all" variants of that problem, and then sell that as a service taking a percentage which is still going to be less than the cost of the customer doing a one-off solution.

Interesting. Do you think they are using something like Deel/Stripe to handle a lot of this ? i mean to figure out the "paying ppl around the world" complexity ... also local payment methods .. currencies .. compliance .. tax docs etc ?

This (money transfer) is one thing Pix would solve trivially.

Any universal system would. The problem is there isnt a universal system.

That's untrue because it assumes all systems are interchangeable just because they are centralized and global, but intention matters and how you operate them creates hidden incentives that can alter how these systems evolve over time. Pix in Brazil, unlike other solutions, is entirely state-run and shouldn't suffer from investor pressure. It can still potentially suffer from service quality degradation and lack of transparency, but enshitification and anti-consumer practices are also very much present in private-owned initiatives, so it's not exclusive to this project.

Yeah, but it only works in Brazil. There's no political will for the US to adopt a Brazilian payment system, and plenty of political will for that to not happen. The same is true in every country. Europe has the SEPA system (often incorrectly called the IBAN system), but you can't use SEPA to transfer to a US account. When the Ukraine war broke out and Ukraine sought donations, they were asking people to donate to a Deutsche Bank account with SEPA, or a JPMorgan Chase account with ACH, or an Australian National Bank account with whatever system they use in Australia.

Hence the "would solve", but as you identified the US prefers to favor their internal ancient financial structures that aren't fit for current global needs. And it's not like it's doing so in order to prevent someone to acquire strategic leverage, because this tech would benefit everyone equally, but to maintain its stronghold over the world's financial systems (like hackerone) just to extract profit. This is very Roman of the Americans, we gotta admit.

Even if the US modernized its financial infrastructure, it still wouldn't share the same infrastructure as Brazil, China, Mozambique and the EU.

Here's something to think about: All of a country's currency, except for physical cash, is stored inside that country. You may think an American can have a Revolut account holding Australian dollars, but Revolut just has a really big account at some Australian bank, and that bank is where the dollars really are.

When you go to Europe and use your American Visa card to buy something, the system finds someone with accounts in both continents to be the counterparty. USD travels from your American bank to the exchanger's American bank, and from the exchanger's European bank to the merchant's European bank.

How would you extend this system outside a single government? It's like saying all cryptocurrencies should share one blockchain - it's all well and good to say, but how will you actually make that happen?

Unfortunately I think you are right, this is kinda Capitalist Realism but applied for imperialism: it's easier to imagine the end of the world than to imagine that the US (or any regional power for that matter) to cooperate with their neighbors.

I think this applies however only to the US. It's possible that Europe, India, Brazil and other powers to form a infrastructure chain around US to make financial cooperation easier between international economical partners.

It's not even about capitalism. You're asking Bitcoin, Ethereum and Monero to cooperate. What do the technical details of that cooperation actually look like?

I disagree, they don't cooperate just because they operate immersed in competition. Take out competition for instance by state sponsored cooperation treaties and see the technical limitations dissolve by creating the right incentives.

So what's your plan to merge Bitcoin, Monero and Ethereum into a single currency?

I don't need to have this plan to study the VC incentive structure that powers their market competition and is responsible for the market fracture. I might even be wrong in my assessment, but not because I lack this hypothetical plan you are asking.

If other people are telling you that it's technically impossible and you can't even come up with a sketch of a technical design that works, that is a clue that it may be technically impossible.

No country will intentionally make its economy completely reliant on another country unless things are completely in the shitter (like Zimbabwe switching to US$). Even Visa/MC are a problem in Europe and they only act at the highest layers of the stack - there are plenty of ways to transfer money without relying on Visa/MC but cutting them off would already be a huge disruption.

Not sure why we sidetracked to crypto, it's not relevant for the discussion. They wouldn't be suitable for such global payment systems even if they were unified, given their volatility.

> Hence the "would solve"

Yes exactly. Just like other universal systems.

...or UPI (India), wechat pay/alipay (China), SEPA (EU). The problem is that none of these systems are actually global.

Hence "would solve" and not "solves"

These systems are government mandated. You get even more fractured systems without a government mandate - originally it was one per bank, and to get money from one bank to another you had to withdraw and then deposit cash. And there isn't a world government.

The closest we have is cryptocurrency, but it doesn't scale.

p2p crypto transfer? 0% fees, instant

Literally just pay them in bitcoin. They're hackers, they'll be able to handle it.

That solves the literal "how to pay" but so does an envelope full of cash via FedEx. That's not the actual complicated part of legally paying someone for contract work in a foreign possibly-hostile nation.

I'm pretty sure the legal way to pay someone in a sanctioned country is: you can't. Full stop. Especially not for hacking services.

I'm not actually sure how HackerOne skirts around this.

Accountability firewalls, probably. They won't pay a sanctioned country, but they'll turn a blind enough eye to anyone who says they're from a different one.

In the early days Meta (Facebook back then) used to pay bounties by physically mailing pre-paid debit cards, so you are not far off with the idea of envelopes full of cash.

Just pay them in stable coins. That's a solved problem.

Buying stable coins is a mild pain because so many banks think crypto is radioactive. Then you have to wait for your deposited funds to completely settle before you can withdraw the crypto from your account and send it elsewhere. Doable, sure. Easy & convenient, not so much. I wouldn't call it a solved problem in the same way you can hand someone cash, tap to pay with your phone, or pay by scanning a QR Code.

Not anymore! Most places allow this very easily now.

Exactly. Revolut is a bank that allows cryptocurrencies.

HN really is living in their own bubble.

No it doesn't. You can gamble with it, but it doesn't let you own or send it.

> No it doesn't.

Yes it does.

> You can gamble with it, but it doesn't let you own or send it.

You can deposit (receive) and withdraw (send) cryptocurrencies there.

"Owning" is a matter at the private key level which of course you use a self-hosted wallet for "true" ownership. But no argument was made on ownership.

My point still stands that Revolut is a bank that allows cryptocurrencies.

It doesn't let me, it says says sending crypto is temporarily blocked. Maybe they just blocked me.

Highly country specific

Revolut does not have a banking license in the US. At the moment they are a front for another bank. Don't be gullible and believe blindly what the marketing departments tell you.

It works in Europe, which is one of the few advantages we have over the US.

> Revolut does not have a banking license in the US.

The US is not the entire world.

Revolut has major banking licenses in Europe, UK and Mexico. That doesn't mean it is not bank.

Wells Fargo does not operate in the UK, but it is still a major bank in the US and it is still a bank.

Royal Bank of Scotland (RBS) is a bank in the UK. Just because it doesn't operate in the US, does not mean it isn't a bank.

> Don't be gullible and believe blindly what the marketing departments tell you.

Revolut is still a major bank even if they don't operate in the US (yet).

For those who can’t use Revolut: WealthSimple in Canada and Chase in the US offer custodial cryptocurrency accounts.

PITA for a large company to handle stable coins etc with accounting, etc

Also PITA for people as well, we have a 33% tax on crypto selling here in Italy on profits…

why its fucking high ??

Same in a lot of countries - he said profits - it’s a taxable gain like any other asset or holding.

I don't know. It used to be 26%, like capital gains from shares, securities, etc. but since 1st January 2026 crypto is taxed at 33% unless it's euro stablecoins (still 26%).

At this point, I think most crypto investors in Italy will just evade taxes altogether.

Italy has progressive taxes on salary, with marginal rates from 23% to 43%. The latter on income above €50k

And if you've got taxes like that on earned income - shouldn't people with unearned income pay just as much? If your tax on investment gains is too small, you end up with an economy where the salaried worker renting a house pays more tax than their landlord, who owns ten houses.

I think America’s tax policy and redistribution scheme have made it the country where private individuals have the most money in the world - and that saying the landlord should pay just as much tax disincentivizes wealth concentration!

stablecoins arent crypto in EU anymore, its e-money. No tax on converting to euros.

IIRC all cryptocurrency that's money is money (so bitcoin, ethereum, etc but not necessarily project-specific tokens) and if you happen to make or lose money on a currency conversion it doesn't have tax implications.

nope. not the case at all.

But we are talking here about assets you just receive. Not buy and resell.

You can't buy bread with stable coins

Im working on a solution to this. If you are interested pls email me at jommi(at)megaeth.com

Skip the crypto, cut out the middle man, and just pay the hackers in cocaine directly from the board of director's supply.

Probably a similar ecological footprint to Bitcoin too...

You got downvoted, but sadly we have 2026 and it's still not easy to send money to any bank in the world. You can say a lot of bad things about the crypto world, but thats a problem Bitcoin solved two decades ago.

bitcoin is neither cheap and stable

Nor safe. Good luck recalling a wrong crpyto transaction.

> Good luck recalling a wrong crpyto transaction.

No better than recalling a wrong bank transfer or Zelle transaction.

Wrong bank transfers can't get recalled? I know I disputed a debit card transaction and got my money back the other month

In Canada, every bank has Interac e-Transfer, essentially we can easily email or text either other money. It's really wicked, and I'm always amazed other places like America don't have it built into their bank accounts and have to use 3rd-party apps to handle sending money to each other.

But anyway, the point is that it tells you every single time you send a transfer that way to be careful, because you can't undo a transfer after it's been sent. I'm assuming it's the same for most methods of bank transfer? I mean, debit transactions are surely a different beast.

Banks can always try to undo a transaction - it's just not guaranteed to work. AFAIK, credit/debit card reversals are always reversible because if the merchant doesn't have the money, it becomes their bank's problem to get the money or eat the loss. This works because the merchant is easily identifiable, well known, and has a reputation to uphold (at least to their bank). Other methods of transfer don't come with such contractual protection, but can still have best-effort.

They can. Maybe in some jurisdictions they don't have to so they try to avoid it. But if there is crime involved for example, they can be required to do what's inconvenient

Most bank transfers cannot be reversed without agreement between parties. You're using a b2c mindset for a b2b problem. Bitcoin is a b2b tool.

Bangladesh bank got its reversed when hacked by NK. Does that look b2c?

The method of “reversal” was sending the money back, because it was a transfer between banks. The actual method of transfer or underlying currency is of no import in such circumstance.

The entire point is that the bank can send the money back and transaction is always between banks. Whereas in cryptocurrency world transaction is direct. Like with cash, except you can accidentally a million dollars

Can't do that with cash either, yet lots of people are using that.

it's a problem only if you can accidentally 100 000 dollars in cash, most of us can't (the amount of paper makes it tricky)

If the recipient is identifiable they legally have to give the money back and you can press charges if they don't.

And if the jurisdictions don't have a treaty?

That was not my point. Money with bancs also not, if it would be so easy, there would be no problems with nigerian oncles and so on. Good look get your grandmas scammed money back.

It's not just the transfer of cash.

It's also complying with tax and employment laws in the country the hacker is in, to the satisfaction of your legal and finance teams.

Sure, in western-style legal systems you can call them a contractor and they can pay their own tax. Just don't employ them full time for long enough to trigger 'sham contract' rules that would make them employees.

But your corporate legal team doesn't have anyone trained and licensed to give advice on Tajikistan tax and employment law, so they can't approve this proposed contract without hiring an outside legal expert. And of course all suppliers, regardless of country, must agree to our anti-slave-labour policy which permits audits of...

One might say "skip that nonsense, just send the money" - but the larger the company, the more their in-house infosec becomes a load of uptight squares who love compliance and audit. And the kind of companies that can pay out five-figure bounties tend to be pretty large.

Why would you or anyone in your American company care about complying with Tajikistan law?

Less about that. More about “not accidentally funding terrorism” (or, more realistically, not giving money to sanctioned countries which can have significant consequences).

CISO: "We're going to invite random strangers from all around the globe to hack us, and pay them for their findings"

CEO: "I'm not sure I like the idea of us inviting people to hack us - or paying a 'bounty' to hackers holding a knife to our throat. Will they at least agree to a binding NDA and terms of engagement, in advance?"

CISO: "No, they won't."

CEO: "Well, at least if the hackers are in poor countries, a $500 payout for a critical bug will be plenty, right?"

CISO: "No, critical issues will be 10-100x that"

CEO: "Well will the average quality of these reports better than those we get from our hired pentesters?"

CISO: "On average these will be the lowest quality reports you've ever seen. But 0.1% might be gold. Oh, and I need to hire 3 more guys to sift through these terrible reports. Also our sifters might miss the gold."

CEO: "Oh. Well at least we won't be breaking the law though, right?"

CISO: "Uh, about that..."

Many solutions nowadays.

https://www.payoneer.com/ is one of them. Of course this one is a bit racist depending on which contry you were born in.

Race and country of origin are not the same

Reply on news.ycombinator.com