Researcher banned on Valve's bug bounty program publishes second Steam 0-day

Post by shkkmo » Thu, Aug 22, 2019, 3:26 AM UTC

tptacek wrote: post #143

chris_wot wrote: post #85

Earlier quoted context omitted.

H1 could make it a proviso if using their service that rejected but reports are automatically disclosed.

1. The overwhelming majority of rejected H1 reports are garbage. 2. It is not the case that all reporters want their findings disclosed publicly, even if they're rejected. 3. Reporters already retain the right to publish findings however they'd like. The worst H1 or a client can do is kick you off the platform. 4. A bug bounty platform that mandated disclosure of any sort would lose all its customers to the platform…

Post by tptacek » Thu, Aug 22, 2019, 3:44 AM UTC

shkkmo wrote: post #161

tptacek wrote: post #143

Earlier quoted context omitted.

1. The overwhelming majority of rejected H1 reports are garbage. 2. It is not the case that all reporters want their findings disclosed publicly, even if they're rejected. 3. Reporters already retain the right to publish findings however they'd like. The worst H1 or a client can do is kick you off the platform. 4. A bug bounty platform that mandated disclosure of any sort would lose all its customers to the platform…

I can see how automatic disclosure may not be a good fit. However, why doesn't H1 expressly allow reporters the option of public disclosure for all NA or WONTFIX reports?

Post by shkkmo » Thu, Aug 22, 2019, 4:00 AM UTC

tptacek wrote: post #163

shkkmo wrote: post #161

Earlier quoted context omitted.

I can see how automatic disclosure may not be a good fit. However, why doesn't H1 expressly allow reporters the option of public disclosure for all NA or WONTFIX reports?

Among other reasons, because the site is literally stuffed to its gills full of people reporting bullshit security issues, like "user impersonation possible" (if you convince a user to open developer tools and give you their session cookie), and H1 wouldn't be doing any good if it generated a constant stream of people "WONTFIX-disclosing" those reports.

Post by umvi » Thu, Aug 22, 2019, 4:01 AM UTC

codedokode wrote: post #159

umvi wrote: post #152

Earlier quoted context omitted.

Won't sandboxes impact performance of video games? I don't know much about sandboxes except that VMs are often used as sandboxes, and I definitely don't want video games running inside of VMs

Games typically need only access to video adapter, sound card and maybe network. They do not need access to your browser's cookies or history, or documents folder, for example. This probably doesn't require using VM.

Post by tptacek » Thu, Aug 22, 2019, 4:12 AM UTC

shkkmo wrote: post #165

tptacek wrote: post #163

Earlier quoted context omitted.

Among other reasons, because the site is literally stuffed to its gills full of people reporting bullshit security issues, like "user impersonation possible" (if you convince a user to open developer tools and give you their session cookie), and H1 wouldn't be doing any good if it generated a constant stream of people "WONTFIX-disclosing" those reports.

I don't quite follow this reasoning. Are you saying that by allowing people to make their NA / WONTFIX reports public, it will dilute the H1 brand? Does association with H1 have a significant effect of the perceived legitimacy of individual public disclosures? Why does this matter? My presumption is that the "other reasons" are business/political and centered around the desire to provide value to or establish goodwil…