full-disclosure - Re: We're now paying up to $20, 000 for web vulns in our services

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 27 Apr 2012 09:39:09 -0400
From: Charlie Derr <cderr@...ons-rock.edu>
To: full-disclosure <full-disclosure@...ts.grok.org.uk>
Cc: "websecurity@...ts.webappsec.org" <websecurity@...ts.webappsec.org>,
	bugtraq <bugtraq@...urityfocus.com>
Subject: Re: We're now paying up to $20,
 000 for web vulns in our services

On 04/26/2012 08:45 AM, Bob McConnell wrote:
>> From: Michal Zalewski
>> 
>>> A you-only-get-it-when-successful 20,000$ budget from Google is insulting, considering the perhaps massive time
>>> investment from the researcher. [...] and yet they only pay a nice researcher 20 grand? You can't even live on
>>> that. Researchers aren't just kids with no responsibilities, they have mortgages and families
>> 
>> People who want to make a living helping to improve Google security are welcome to apply for a job :-) We have a
>> remarkably large and interesting security team.
>> 
>> The program simply serves to complement that (and some other, contract-driven efforts), and it works for quite a
>> few people who see it as a way to do something useful on the side, and get compensated for it, too.
>> 
>> Now, I have done a fair amount of vulnerability research in my life, I do have a family and a mortgage - and I
>> still wouldn't see $20k as an insult; but I know that this is subjective. In that spirit, you are at liberty to
>> determine whether to participate, and how much time to invest into the pursuit :-)
> 
> Another point that seems to be overlooked in these discussions is that this bounty adds a new vector into the
> decision tree for the black hat. EvilBob now has to decide if that vulnerability he just found is worth more for his
> usual nefarious uses than the cash reward. In some cases, this might result in discoveries being reported for the
> reward instead of being used to attack the servers, converting the black hat over to white. I suspect the likelihood
> of this outcome increases exponentially with the size of the reward.
> 
> Bob McConnell
> 

>>From a strictly pragmatic point of view, I find this argument complete (and somewhat compelling).  From a "moral"
standpoint it does leave a bad taste in my mouth though, as I have no illusions at all that anyone has been "converted"
from black hat to white hat (except for that single case where a bounty is being offered).  And there is the reality
then that a black hat's actions are being "rewarded" (and the possibility (already expressed on some of these lists)
that there will be a future expectation from other entities to similarly "reward" such behavior).

   anyhow, that's my $.0199999... (for whatever it's worth),
         ~c

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/