Meet the bughunters: the hackers in India protecting your data

#1

Post by cichli » Sun, Apr 10, 2016, 12:18 PM UTC

Meet the bughunters: the hackers in India protecting your data
theguardian.com

Re: Meet the bughunters: the hackers in India protecting your data

#2

Post by nxzero » Mon, Apr 11, 2016, 1:25 AM UTC

Amazing that all publicly traded companies are not by law required to have bug bounties.

Same goes for any major open source project too.

Re: Meet the bughunters: the hackers in India protecting your data

#3

Post by ludamad » Mon, Apr 11, 2016, 2:25 AM UTC

nxzero wrote: post #2

Amazing that all publicly traded companies are not by law required to have bug bounties. Same goes for any major open source project too.

At what point should a piece of software have a bug bounty? It seems forcing bug bounties would cause them to become purposefully convoluted to obtain

Re: Meet the bughunters: the hackers in India protecting your data

#4

Post by nxzero » Mon, Apr 11, 2016, 3:21 AM UTC

ludamad wrote: post #3

nxzero wrote: post #2

Amazing that all publicly traded companies are not by law required to have bug bounties. Same goes for any major open source project too.

At what point should a piece of software have a bug bounty? It seems forcing bug bounties would cause them to become purposefully convoluted to obtain

Just even having a page, with a small bounty, and a secure means of submitting a exploitable bug. If you want to dig deeper, I'd contact professional bug hunters and ask them how to insure that the value on the bug matches the reward.

Re: Meet the bughunters: the hackers in India protecting your data

#5

Post by ashitlerferad » Mon, Apr 11, 2016, 4:13 AM UTC

nxzero wrote: post #2

Amazing that all publicly traded companies are not by law required to have bug bounties. Same goes for any major open source project too.

Open source projects rarely have a budget for development, let alone bug bounties.

Re: Meet the bughunters: the hackers in India protecting your data

#6

Post by cderwin » Mon, Apr 11, 2016, 5:48 AM UTC

nxzero wrote: post #2

Amazing that all publicly traded companies are not by law required to have bug bounties. Same goes for any major open source project too.

Yes why don't we incentivize companies to keep more software closed source than already is

Re: Meet the bughunters: the hackers in India protecting your data

#7

Post by debarshri » Mon, Apr 11, 2016, 7:35 AM UTC

I think guardian didn't do their homework right. Apparently Rahul tyagi just like Ankit fadia is considered to be a con-artist.

https://news.ycombinator.com/item?id=4316574

Re: Meet the bughunters: the hackers in India protecting your data

#8

Post by OJFord » Mon, Apr 11, 2016, 10:24 AM UTC

    > rupee millionaire

I don't wish to put down Mr Prakash's achievements, but is that actually a celebrated figure in India - or at ~£10.6k is the word 'millionaire' just a sensationalism for our benefit?

Re: Meet the bughunters: the hackers in India protecting your data

#9

Post by ing33k » Mon, Apr 11, 2016, 10:39 AM UTC

OJFord wrote: post #8

> rupee millionaire I don't wish to put down Mr Prakash's achievements, but is that actually a celebrated figure in India - or at ~£10.6k is the word 'millionaire' just a sensationalism for our benefit?

approx 1 year salary for a guy working in IT sector with 2-3 years experience

Re: Meet the bughunters: the hackers in India protecting your data

#10

Post by ugexe » Mon, Apr 11, 2016, 1:24 PM UTC

nxzero wrote: post #4

ludamad wrote: post #3

Earlier quoted context omitted.

At what point should a piece of software have a bug bounty? It seems forcing bug bounties would cause them to become purposefully convoluted to obtain

Just even having a page, with a small bounty, and a secure means of submitting a exploitable bug. If you want to dig deeper, I'd contact professional bug hunters and ask them how to insure that the value on the bug matches the reward.

And if you can't afford to pay a bounty just don't write software right?

Don't you think it's odd your answer to what you are replying to is "I have no idea, ask someone who knows" yet you feel compelled to weigh in on who should not be allowed to write/distribute software?