« first day (2510 days earlier)      last day (2668 days later) » 

Arminius
Arminius
14:32
Wow, here is something I really don't get:
8
Q: Is demanding a "donation" before disclosing vulnerabilities black hat behavior?

JaccoWe have been contacted by an "independent security researcher" through the Open Bug Bounty project. First communications were quite OK, and he disclosed the vulnerability found. We patched the hole and said "thank you", but declined to pay a donation (because of various reasons). The researcher ...

disclosure black-hat
Why does everybody agree you have to pay a security researcher for vulnerabilities if you never asked them nor gave them permission?
The comment section is quite hostile towards the asker
 
2 hours later…
djsmiley2k
djsmiley2k
16:57
@Arminius not sure about the comments, but the answers don't see to say that
But I do wonder about places signing up for the 'Open bug bounty project' and not actually offering bounties
Arminius
Arminius
17:17
@djsmiley2k That's the whole point. They did not sign up anywhere.
The project offers to be an intermediary between researchers and companies that don't have a bug bounty program.
Buffalo5ix
Buffalo5ix
18:02
@armin
@Arminius accidental comment above ^

I do agree that there shouldn't be any implicit requirement to pay em out. Especially with what they've said about the vulnerability details I'd have to assume it was a small severity issue that wouldn't justify a large bounty. That being said there's no implicit requirement for the bug finder to offer bugs to the company as long as they're not selling/publishing the vulns. Both sides are looking out for their best interests.
Arminius
Arminius
18:42
@Buffalo5ix Well, I'd still go a bit further: If you happen to know about a major vulnerability, you somewhat have a moral obligation to report it. Especially if the effort of reporting it is small and the potential damage of the vulnerability big.

« first day (2510 days earlier)      last day (2668 days later) »