Date: Tue, 25 Sep 2018 19:10:23 +0000 From: Jeremy Stanley <fungi@...goth.org> To: oss-security@...ts.openwall.com Subject: Re: bounties [Full Disclosure ML dropped from followup] On 2018-09-21 21:12:15 -0700 (-0700), Justin Ferguson wrote: > I was curious about peoples experiences with bug bounties > particularly those through the prominent clearing houses for them. > My experience is that I have been either ripped off or extremely > slow-walked in payment that was substantially below the listed > payout in every single instance. I'm curious how accurately that > reflects other peoples experiences. [...] As someone handling intake of suspected vulnerability reports for a large community of free/libre open source software projects, I've seen another side of it. The projects I work on have been incorrectly added and re-added to lists of supposed bug bounty targets over the years, and it's caused us to deal with floods of useless reports from everyone who can figure out how to run a static code analyzer, fuzzer or vulnerability scanner (and also people who can't even figure out the difference between the projects and the code which powers their community Web sites). Convincing the people who maintain those clearing house lists to de-list your projects can be a challenge, as they're just as likely to ignore you, or even simply be abandoned Web sites with nobody at the helm. If this is the sort of experience other projects endure, I can't imagine why any would willingly put themselves on such bounty registries. I have much more interest in dealing with reports of suspected vulnerabilities from engaged users of the software than from people out to make a quick buck, disinterested in even following up enough on the bugs they think they've found to determine they're unreachable cruft or even intentional features of the software. -- Jeremy Stanley Download attachment "signature.asc" of type "application/pgp-signature" (964 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.