8 ms·

Then what is the purpose of bug bounties in your perspective?

billyhoffman 13y ago
I think bug bounties can make the risk/reward ratio palatable, by either lowering risk or increasing the reward. If a company offers monetary awards for web vulnerabilities in their site, that's a good sign. It shows they recognize the monetary value on what you are doing and made the decision to reward you. It shows the extent of their commitment to the bounty program that they have allocated budget and have accepted the added accounting challenges to provide money for issues. It also means that have thought through exactly what they are expecting and what they are willing to pay. In my eyes, someone offering marketing swag or "putting your name on a web page" doesn't think your work is as valuable. Thus they are more likely to be angry and seek legal remedies should your testing cause them harm in some way, because in their eyes the value of your security testing or your findings doesn't out weight the damage. In short, all of this is an indicator of how much thought was put into the company's policy on finding and reporting security issues, and how mature their reaction will be to things they have not thought of or bad things happen. The less mature, the more likely they are to decide your testing was "unauthorized" and to seek legal remedies. Compare Spotify's policy [1] with Google's Policy[2]. Which one has put more thought and planning into running a program like this? Obviously people's risk/reward appetites differ... Please note that I am taking the risks of bug bounties/"its ok to audit us" policies that apply public websites. The Stripe/Matasano challenges are specially created systems and are always a great thing to do. [1]- https://www.spotify.com/dk/about-us/contact/report-security-issues/ https://www.spotify.com/dk/about-us/contact/report-security-... [2]- http://www.google.com/about/appsecurity/reward-program/ http://www.google.com/about/appsecurity/reward-program/

I think bug bounties can make the risk/reward ratio palatable, by either lowering risk or increasing the reward. If a company offers monetary awards for web vulnerabilities in their site, that's a good sign. It shows they recognize the monetary value on what you are doing and made the decision to reward you. It shows the extent of their commitment to the bounty program that they have allocated budget and have accepted the added accounting challenges to provide money for issues. It also means that have thought through exactly what they are expecting and what they are willing to pay. In my eyes, someone offering marketing swag or "putting your name on a web page" doesn't think your work is as valuable. Thus they are more likely to be angry and seek legal remedies should your testing cause them harm in some way, because in their eyes the value of your security testing or your findings doesn't out weight the damage. In short, all of this is an indicator of how much thought was put into the company's policy on finding and reporting security issues, and how mature their reaction will be to things they have not thought of or bad things happen. The less mature, the more likely they are to decide your testing was "unauthorized" and to seek legal remedies. Compare Spotify's policy [1] with Google's Policy[2]. Which one has put more thought and planning into running a program like this? Obviously people's risk/reward appetites differ... Please note that I am taking the risks of bug bounties/"its ok to audit us" policies that apply public websites. The Stripe/Matasano challenges are specially created systems and are always a great thing to do. [1]- https://www.spotify.com/dk/about-us/contact/report-security-issues/ https://www.spotify.com/dk/about-us/contact/report-security-... [2]- http://www.google.com/about/appsecurity/reward-program/ http://www.google.com/about/appsecurity/reward-program/