Researcher banned on Valve's bug bounty program publishes second Steam 0-day
1–10 of 214 posts
Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day
#2I mean, you can't have your cake and eat it too - if you claim that a particular issue is not a bug and you won't fix it, then you have no ethical grounds to say that it shouldn't be disclosed.
Responsible disclosure expects delaying public disclosure to protect the users while the vendor prepares a fix. If the vendor says that they won't fix it, then it's not only a right, but a moral duty to disclose that vulnerability to the users.
Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day
#3This story continues to be so sad. Steam is reprising the role of Adobe who, for quite a while, refused to acknowledge that being able to use FlashPlayer as a tool to get you something on Windows was just as bad as breaking FlashPlayer. I heard one Adobe executive say, "Hey you can use a baseball bat to bludgeon someone but that isn't the bat maker's fault is it? If they are forced to make foam bats their product is useless."
That position isn't "wrong" so much as it isn't useful in reducing risk.
Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day
#4The salient part seems to be that the researcher reported the first vulnerability through HackerOne and was (reportedly) told by Steam it wouldn’t be fixed. He then published it after being instructed that was against the rules and was banned
Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day
#5I mean, you can't have your cake and eat it too - if you claim that a particular issue is not a bug and you won't fix it, then you have no ethical grounds to say that it shouldn't be disclosed. Responsible disclosure expects delaying public disclosure to protect the users while the vendor prepares a fix. If the vendor says that they won't fix it, then it's not only a right, but a moral duty to disclose that vulnerabi…
I had the same argument with Coinbase about this one...
Ended up naming it 'Bad QR', putting this page together and sending them a private link (https://writecodeeveryday.github.io/projects/badqr/)
Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day
#6a) Program has scope that doesn't include X
b) Researcher reports vulnerability that falls under X
c) Since it's out of scope, it's closed as N/A
d) Report is locked because company doesn't want to publicly disclose a vulnerability in their system via the Hackerone platform
What's the problem here? Just go with normal vulnerability disclosure. Bug bounty programs are a two way street, and respecting the scope is part of that.
Edit: I guess the important part is that the researcher was then banned for disclosing the report. Seems reasonable, honestly. I don't agree with it, but I understand it.
Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day
#7I mean, you can't have your cake and eat it too - if you claim that a particular issue is not a bug and you won't fix it, then you have no ethical grounds to say that it shouldn't be disclosed. Responsible disclosure expects delaying public disclosure to protect the users while the vendor prepares a fix. If the vendor says that they won't fix it, then it's not only a right, but a moral duty to disclose that vulnerabi…
I had the same argument with Coinbase about this one... Ended up naming it 'Bad QR', putting this page together and sending them a private link ( https://writecodeeveryday.github.io/projects/badqr/ )
Please fix your jquery import, it's being blocked b/c it's coming over http not https
Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day
#8I mean, you can't have your cake and eat it too - if you claim that a particular issue is not a bug and you won't fix it, then you have no ethical grounds to say that it shouldn't be disclosed. Responsible disclosure expects delaying public disclosure to protect the users while the vendor prepares a fix. If the vendor says that they won't fix it, then it's not only a right, but a moral duty to disclose that vulnerabi…
The researcher can still disclose it, they just aren't going to get permission to disclose it on the Hackerone program. Most things out of scope don't get publicly disclosed as far as I know.
Doesn't seem too unreasonable.
Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day
#9The salient part seems to be that the researcher reported the first vulnerability through HackerOne and was (reportedly) told by Steam it wouldn’t be fixed. He then published it after being instructed that was against the rules and was banned
"Please don't do thing"
does thing
gets banned
shocked
Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day
#10This story continues to be so sad. Steam is reprising the role of Adobe who, for quite a while, refused to acknowledge that being able to use FlashPlayer as a tool to get you something on Windows was just as bad as breaking FlashPlayer. I heard one Adobe executive say, "Hey you can use a baseball bat to bludgeon someone but that isn't the bat maker's fault is it? If they are forced to make foam bats their product is…
You're beating a dead horse. Flash served a purpose once, and now it's reached end-of-life.