Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Beg Bounties (2021)

troyhunt.com

Post reply on HN
Print view View original

121–130 of 174 posts

Re: Beg Bounties (2021)

#121

Post by __s »

geek_at wrote: post #93
waihtis wrote: post #90

Earlier quoted context omitted.

No criticism because teenagers do dumb things, but for anyone else it should be assumed that if you break into a system without permission, benignly or not, you run the risk of getting prosecuted for it.

Oh yes. In 2011 I got raided by the police because I clicked a link someone sent me over IRC [1]. You don't even need to be destructive to become a target for prosecution sometimes. Being stupid or incautious is enough. [1] https://blog.haschek.at/2015-that-not-so-awesome-time-the-po...

> Don't click on links from random people on the internet!

Ironic since I ended up on your blog after clicking on link you posted

Re: Beg Bounties (2021)

#122

Post by grotorea »

mgaunard wrote: post #69

I remember when I was a teenager I found a huge security flaw in a website: they allowed to include any PHP file passed as a query string parameter, and that file could be a remote one too. They didn't listen to me and I found that offensive, so I used the flaw to get access, and leave a message on their FTP server. I didn't destroy nor steal any data. They responded by reporting the incident to the police.

Nice welcome to the grey hat experience.

Re: Beg Bounties (2021)

#123

Post by malfist »

bigfudge wrote: post #74
onion2k wrote: post #70

Earlier quoted context omitted.

Not tolerated but it should be understood . Lots of developers would do morally dubious things for a 'life-changing' amount of money. If you live in a very poor country that isn't a large sum compared to a Western salary.

It’s not hypothetical. Lots of developers do do morally dubious things in the west for large amounts of money!

I mean, I work at Amazon

Re: Beg Bounties (2021)

#124

Post by 3c6bYDXLMj »

throwaway2037 wrote: post #91
ipython wrote: post #35

Earlier quoted context omitted.

“But I already washed your window while sitting at the stop light” It’s one thing to go begging, it’s another when they feel entitled to some sort of payout. I never asked for their “services” - and in my limited experience, they lash out at you too, when you explain you’re not paying.

My parents lived in New York City during the early 1970s, a time of serious decay. The "free" car window washers was a thing. You would stop in traffic (Manhattan) usually, then someone would start to clean your front window with a dirty squeegee, then come to your driver side window and ask for a tip (payment). By the time it started showing up in 1980s comedy films, it was mostly gone in real life. I am surprised t…

[dead]

Re: Beg Bounties (2021)

#125

Post by scotty79 »

plugin-baby wrote: post #111
pilchard123 wrote: post #110

Earlier quoted context omitted.

IIRC some jurisdictions consider any force at all - such as pushing an already-open door further open - to be sufficient to make it B&E rather than simply trespassing.

Force isn’t even required in some places, apparently! This page expands on the differences in a few countries: https://en.m.wikipedia.org/wiki/Burglary Canada > Breaking and entering is defined as breaking into a place with intent to commit another indictable offence England & Wales > A person is guilty of burglary if they enter any building or part of a building as a trespasser with intent to steal, inflict grievous…

It seems that in many places intent to commit another crime is a key.

Re: Beg Bounties (2021)

#126

Post by thaumasiotes »

duskwuff wrote: post #48
thaumasiotes wrote: post #42

Earlier quoted context omitted.

Why would it be? Say you film your kid's birthday party and put it up on youtube. You just leaked voice recordings of a lot of other children. What's the harm supposed to be?

As of 2013, COPPA specifically defines recordings of a child's voice as a type of "personal information" about the child; as a result, operators of online services "directed at children" are required to get parental consent to collect that information, and are required to protect it appropriately. https://www.ftc.gov/news-events/news/press-releases/2012/12/...

If the only problem with something is that it's illegal, why not stop making it illegal?

Re: Beg Bounties (2021)

#127

Post by blincoln »

throwaway2037 wrote: post #91
ipython wrote: post #35

Earlier quoted context omitted.

“But I already washed your window while sitting at the stop light” It’s one thing to go begging, it’s another when they feel entitled to some sort of payout. I never asked for their “services” - and in my limited experience, they lash out at you too, when you explain you’re not paying.

My parents lived in New York City during the early 1970s, a time of serious decay. The "free" car window washers was a thing. You would stop in traffic (Manhattan) usually, then someone would start to clean your front window with a dirty squeegee, then come to your driver side window and ask for a tip (payment). By the time it started showing up in 1980s comedy films, it was mostly gone in real life. I am surprised t…

FWIW, it was pretty common in Vancouver, BC when I lived there in the late 90s.

Re: Beg Bounties (2021)

#128

Post by blincoln »

aidos wrote: post #101
ipython wrote: post #3

I run a domain for our community association. I had an “ethical hacker” discover that I had neglected to set up spf records for that domain. I had to deal with him sending a bunch of nasty emails to our other board members after I refused to pay him for his “discovery”. (Actually I offered him a cut of my salary as a board member, which at $0, came out to be… less than he was hoping for) I’ll definitely keep a link t…

As a general rule, you really do want to set up SPF, dkim and dmarc. Without them there’s a real vulnerability there. The annoying case is when you have them correctly configured but are using ~all instead of -all so you still need to deal with the beg bounties.

Yeah, I'm honestly surprised the organization is able to email anyone else. Even 8-10 years ago, I would have expected the major providers to drop email sent from a host without some or all of those elements configured.

Re: Beg Bounties (2021)

#129

Post by blincoln »

Ayesh wrote: post #78
eknkc wrote: post #77

Earlier quoted context omitted.

You receive 20 mails each day and when you delete them you receive follow ups. You receive emails getting angry and the tone shifts to threats (as if the bug they are reporting warrants it). These bury any legitimate reports. We have missed a legit one because of the sheer amount of beggers at some point. Luckilty the person on the other end contacted us again and was understanding that we missed it. And there are so…

Quoted from the post: > It was _immediately_ clear that Hammad was going to beg for a bounty, but it was a quiet Saturday night here and I thought it would be entertaining to see just how far down the rabbit hole he wanted to go. So, I responded, positively: I suppose most of these useless bounty reports are quite easy to tell. From the comment above: > 20 mails each day If you receive 20 mails a day to your security…

From what I've seen secondhand, a bug bounty programme can actually increase the overhead vs. an email address, because now someone has to log in and deal with each ticket instead of ignoring emails that don't seem interesting.

There are some significant advantages to having a bug bounty programme, but they still attract a lot of noise. I know of at least one software company that has an entire team just to triage the queue. Not fix anything, just validate whether a report ia reproducible or not and if so, route it to the responsible party.

Re: Beg Bounties (2021)

#130

Post by Ayesh »

blincoln wrote: post #129
Ayesh wrote: post #78

Earlier quoted context omitted.

Quoted from the post: > It was _immediately_ clear that Hammad was going to beg for a bounty, but it was a quiet Saturday night here and I thought it would be entertaining to see just how far down the rabbit hole he wanted to go. So, I responded, positively: I suppose most of these useless bounty reports are quite easy to tell. From the comment above: > 20 mails each day If you receive 20 mails a day to your security…

From what I've seen secondhand, a bug bounty programme can actually increase the overhead vs. an email address, because now someone has to log in and deal with each ticket instead of ignoring emails that don't seem interesting. There are some significant advantages to having a bug bounty programme, but they still attract a lot of noise. I know of at least one software company that has an entire team just to triage th…

I participate in a couple programs, and when I report something, they have a team at the bug reporting service take a look first before escalating them to the actual security contact. Only issues that are in-scoope and severe enough get escalated. The company can even mark certain programs as invitee-only or for researchers above a certain threshold.

Many programs already have rules saying they will not consider DNS/header related issues.

Post reply on HN