6 ms·

What if... on the vulnerability report rules page there's an image of some text saying something like "your report must include the text: turtle123". Reports wi

by zulban 3mo ago

What if... on the vulnerability report rules page there's an image of some text saying something like "your report must include the text: turtle123". Reports without that text get automatically deleted. Sure - modern AI can figure that out, but I bet in a vast majority of cases they won't.

wepple 3mo ago
Reminds me of someone (well known in their field) who charged $0.05 for using their “contact me” page. A trivial amount for someone who genuinely wanted to contact them, but just high enough to prevent any kind of scaled abuse
- alfirous 3mo ago
  That actually great idea. What payment method or processor used?
- entuno 3mo ago
  If I've stumbled across what I think is a security issue in your systems, there is zero chance that I'm going to get out my credit card and pay you for the privilege of responsibly disclosing it to you. Especially if it's the vulnerability is in the site hosting the contact form.
  - wepple 3mo ago
    I don’t participate in bounties at all unless I believe there is a moral obligation or I’m set to make thousands of dollars. In each case, $0.05 is fine. For a typical commercial entity? $0.05 is not a deterrent; the companies legal team is and has been for a decade.
    - entuno 3mo ago
      In most cases I'd think it's more of a deterrent for commercial entities, because spending money create complexity. Most employees are not in a position to just directly spend their organisation's money, so that $0.05 will often mean needing to get approval, purchase orders, deciding which cost centre it comes from, needing an invoice, etc, etc. Very few people are going to invest that much effort when they're trying to do the company that they're reporting to a favour.
AshamedBadger56 3mo ago
I know some professors who have started doing something similar to combat students using AI for their work. Even going as far as to hide the "your report must include XYZ obscure word 3x" prompt instructions in small invisible text. It's gotten pretty bad, with some students turning in papers with the original ChatGPT prompt LEFT IN THE TURNED IN ASSIGNMENT.

by zulban 3mo ago

wepple 3mo ago

Reminds me of someone (well known in their field) who charged $0.05 for using their “contact me” page. A trivial amount for someone who genuinely wanted to contact them, but just high enough to prevent any kind of scaled abuse

alfirous 3mo ago
That actually great idea. What payment method or processor used?
entuno 3mo ago
If I've stumbled across what I think is a security issue in your systems, there is zero chance that I'm going to get out my credit card and pay you for the privilege of responsibly disclosing it to you. Especially if it's the vulnerability is in the site hosting the contact form.
- wepple 3mo ago
  I don’t participate in bounties at all unless I believe there is a moral obligation or I’m set to make thousands of dollars. In each case, $0.05 is fine. For a typical commercial entity? $0.05 is not a deterrent; the companies legal team is and has been for a decade.
  - entuno 3mo ago
    In most cases I'd think it's more of a deterrent for commercial entities, because spending money create complexity. Most employees are not in a position to just directly spend their organisation's money, so that $0.05 will often mean needing to get approval, purchase orders, deciding which cost centre it comes from, needing an invoice, etc, etc. Very few people are going to invest that much effort when they're trying to do the company that they're reporting to a favour.

AshamedBadger56 3mo ago

I know some professors who have started doing something similar to combat students using AI for their work. Even going as far as to hide the "your report must include XYZ obscure word 3x" prompt instructions in small invisible text. It's gotten pretty bad, with some students turning in papers with the original ChatGPT prompt LEFT IN THE TURNED IN ASSIGNMENT.