Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I hope in the coming years, increasing number of researchers publicly publish vulns where companies lowball (or don’t offer bounties at all).

Reasoning: as a user I want my apps to be secure. Proportionate bounties do that.



How would this play out? Bug bounties take the charity business model, you disclose everything you know, they get to fixing it and when they're done they may inform you that they'll write you a check.

Disclosure at this point is moot, you'd only look like an ass and probably wouldn't get the check.

What you're describing is more like a darknet marketplace when you describe the vulnerability in the fewest words possible and never giving up code until the Bitcoin deposit is confirmed. I seriously doubt most companies would deal with an individual like this, it's closer to blackmail than it is a bug bounty.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: