There... there's another Buffalo

@Arminius I'm guessing because they were less than clear about what happened. I was under the impression they were participating in a bounty program on first read too

it actually took until reading the chat here to figure out what happened

either way, someone questioning if it is black hat behavior to not simply give up information they had to work to figure out for no compensation is still a bit... well I'm not sure what the right word is

so I can understand some frustration there

@Arminius why? You don't have to work for free and we're most likely not talking about something that will have anything other than financial implications. Many severe bugs are never exploited.

If it takes skill to find something, then that skill should be compensated for the effort

it isn't like it is going to kill someone. The damage is generally limited to financial liability

but I suppose it might also depend on what the possible damage was

even then I'm not sure I'd buy the argument beyond pointing out that a vulnerability exists

and then seeking to establish fair value

@Arminius oooooooooooooo ok

then lol how can anyone expect anything

@MarkBuffalo When you look at the new tags page and find [time-travel], [advanced-delusionary-schisophrenia] and [earth-in-the-middle-attacks] on the list... Yeah, that was a glorious post!

@Anders WAT, wth post wasa referring to that??

I see we need to go back to monitoring the new tags page... Please everyone check once in a while what garbage has infiltrated this... security.stackexchange.com/tags?tab=new

@AviD security.stackexchange.com/questions/172515/… The tags were quite good descriptions of the post, but obviously not meant to stay. :-)

tags are NEVER supposed to be a description of the post...

ahh okay read it now.

lol thanks for that

> I'm voting to close this question as off-topic because it's unclear what you're smoking

lol @MarkBuffalo

Anyway, keeping an eye on the new tags page is a good idea... Lots of duplicates popping up there.

and garbage tags.

in fact at this point new tags are often a good indicator of questions that need to be nuked.

(not always though - someone just legit added machine-learning)

That was me.

heh nice

I'm surprised by how many of the new tags are just misspellings of old ones.

@Anders yeah, thats not even lazy - its going out of your way to be dumber than necessary.

we used to call that "doing a simon" or "a simonism". ;-)

Who's Simon?

@Anders actually just heard a great talk at AppSecIL about injecting malicious data to ML systems.

@AviD Yeah, I think we can expect that to get big as more and more consumer products are based on ML.

@Anders ah, why does the internet have so few high quality trolls anymore?

that post is a work of art

draws you in till the end and then WTF!!!?

@AviD ah poor simon... I miss him

is that slack channel still going or wherever it went. I sadly didn't have time to monitor yet another feed on the internet

@Anders he was a common chatter in DMZ back in it's wild west days

he was a good dude who was learning but made some really unfortunate mistakes a couple of times and picked up a good natured humorous reputation... also, he loved the attention

probably wouldn't fly anymore after things got a bit bigger and SE started being a bit more strict on "Be Nice". Believe it or not DMZ used to be the just slightly to the right side of the line version of Mos Eisley

and if you aren't familiar with Mos Eisley you "missed out"

(if by missed out, you mean a large number of mods have a lot less work to do after Shog perma-nuked it)

@AJHenderson Clearly I missed out! Better find myself one of those time travellers to take me back...

@AJHenderson I still am baffled by anyone using time to write something like that.

@RoryAlsop some people are very VERY bored

it's basically the internet version of a practical joke though

and honestly, I do have a fair bit of respect for people who can write one well

that said, they still don't belong on a resource site like SE

@AJHenderson I sort of agree, however: if someone can write a really good one they can also do something constructive.

@RoryAlsop sure, but sometimes people like to do stuff for fun rather than being constructive

and often times those "trolls" also do constructive stuff

not on SE since it isn't the place, but in communities that are more social and non-purpose driven

in Wow, I'll do intelligent trolling of the trolls that are just trying to annoy people

and we have a few other people who are just practical jokers that also do a lot of positive stuff

but there's certainly a time and a place

@AJHenderson If you stumble upon something dangerous, it's sometimes just nice to let them know without demanding compensation. What I don't understand is why everyone has been ignoring that the researcher never had any permission. How is that "white-hat behavior".

To me it looked like OP felt intimidated by a researcher that he perceived as being aggressive and pushy. And the answers essentially said he should be thankful for the work he received and move on.

@Arminius I think that is probably again part of the misunderstanding of what the open bug bounty program is

until reading chat, I didn't realize what it was

that said, it's possible it was something obvious that first got the guy's attention and I'll do a non-invasive check of a service I use if I see something that clearly worries me

I wouldn't say that looking around without touching is black hat if you can see the door is open. It's more checking if there's already a burglar in the house and rethinking if you want to store your valuables there

I would feel obligated to say "hey, your door is open" but not to say "you should really replace this lock, put a camera there and maybe get a guard dog"

one is letting them know there is a problem, the other is solving it for them

or atleast telling them how to solve it

and don't get me wrong, that question has a whole lot of bad on all sides

but I think the OP's tone came off as a bit harsh to start with as well as being very unclear what he was saying

which I think made it sound even more harsh

@AJHenderson Exactly, and I'm not saying the researcher should give free advice how to keep the house secure. But if you walk around the neighborhood and see a door wide open, I think it's a nice gesture to quickly let the owner know.

And if someone came to my house and said "I checked your home for ways to break in and I found three major issues that I would tell you for 1000 usd", I would feel intimidated rather than thinking "that's so nice of him, and of course he wants compensation for his work".

@Arminius true, but that's also not what happened. It was someone walking by and noticing you had an issue, saying "hey, I was walking by and noticed your house is unlocked and the deadbolt isn't very secure." "ok, thanks" "you do have some other security issues I can let you know about if you pay me"

since your security guard either hasn't noticed or doesn't seem to care

@AJHenderson Well, OP claimed the bugs were found using a security scanner (and I think it's safe to assume the tool did more than just look around), so it's more than just walking by and noticing something. But I guess what we can agree on is that the question wasn't a great fit for SecSE as it left us speculate about what they really said and mostly invited opinions.

@Arminius depends on the scanner, though he did point out one showed up in the log which is at least partly active

so yeah, I guess I can see either side

@Anders <3

@RoryAlsop Yeah, this

@Arminius This is a big problem at a lot of companies. If you don't pay out enough, they often take the vuln and sell it on the dark net. It's like light extortion or something

So I think it's sort of a grey area. Can't prove who they are, can't prove their intentions because they can argue otherwise.

But it's definitely black-hattish.