Re: bounties

[Jeremy Stanley <fungi () yuggoth org>]

[Full Disclosure ML dropped from followup]

On 2018-09-21 21:12:15 -0700 (-0700), Justin Ferguson wrote:
> I was curious about peoples experiences with bug bounties
> particularly those through the prominent clearing houses for them.
> My experience is that I have been either ripped off or extremely
> slow-walked in payment that was substantially below the listed
> payout in every single instance. I'm curious how accurately that
> reflects other peoples experiences.
[...]

As someone handling intake of suspected vulnerability reports for a
large community of free/libre open source software projects, I've
seen another side of it. The projects I work on have been
incorrectly added and re-added to lists of supposed bug bounty
targets over the years, and it's caused us to deal with floods of
useless reports from everyone who can figure out how to run a static
code analyzer, fuzzer or vulnerability scanner (and also people who
can't even figure out the difference between the projects and the
code which powers their community Web sites).

Convincing the people who maintain those clearing house lists to
de-list your projects can be a challenge, as they're just as likely
to ignore you, or even simply be abandoned Web sites with nobody at
the helm. If this is the sort of experience other projects endure, I
can't imagine why any would willingly put themselves on such bounty
registries. I have much more interest in dealing with reports of
suspected vulnerabilities from engaged users of the software than
from people out to make a quick buck, disinterested in even
following up enough on the bugs they think they've found to
determine they're unreachable cruft or even intentional features of
the software.
-- 
Jeremy Stanley

Attachment: signature.asc
Description: