GitHub Security Bug Bounty
github.com
GitHub Security Bug Bounty
1–10 of 38 posts
Re: GitHub Security Bug Bounty
#2Isn't $5000 ridiculously low compared to the black market value of a GitHub exploit, or the time required to develop it?
Assuming a company thinks it's pretty secure, putting real money on the line (the same money you'd normally pay an expert to pentest your system) would get some more prolific minds involved.
Re: GitHub Security Bug Bounty
#3Isn't $5000 ridiculously low compared to the black market value of a GitHub exploit, or the time required to develop it? Assuming a company thinks it's pretty secure, putting real money on the line (the same money you'd normally pay an expert to pentest your system) would get some more prolific minds involved.
Bug bounties are rarely competitive with their black-market value. I think in most cases they're intended more as a "thanks!" than a "please don't hack us".
Re: GitHub Security Bug Bounty
#4Isn't $5000 ridiculously low compared to the black market value of a GitHub exploit, or the time required to develop it? Assuming a company thinks it's pretty secure, putting real money on the line (the same money you'd normally pay an expert to pentest your system) would get some more prolific minds involved.
No, it is probably not. People have weird ideas about how much random web bugs are worth. Big ticket bugs are easily monetizable, and/or attack a huge install base with a very slow patch cycle. People hear about 5-6 figure bugs, but those are typically reliable browser clientside RCEs.
Re: GitHub Security Bug Bounty
#5Isn't $5000 ridiculously low compared to the black market value of a GitHub exploit, or the time required to develop it? Assuming a company thinks it's pretty secure, putting real money on the line (the same money you'd normally pay an expert to pentest your system) would get some more prolific minds involved.
Someone on the black market will almost always pay more than a company. The real value in responsible disclosure is typically from a consulting contract that may follow the report. Their leaderboard list also seems like a good way to build credibility in the community as well.
Re: GitHub Security Bug Bounty
#6Isn't $5000 ridiculously low compared to the black market value of a GitHub exploit, or the time required to develop it? Assuming a company thinks it's pretty secure, putting real money on the line (the same money you'd normally pay an expert to pentest your system) would get some more prolific minds involved.
It is easy to think that but I think that isn't the case for a few reasons:
- You only need one person to report it, and so if Nefarious Nigel has found it and is planning to use for profit, then Sweet Sarah find it and reports it then it worked. I imagine this is the case for the majority of bugs (but can't prove it).
- $5000 isn't in a different order of magnitude to Google's rewards, and they paid out several million dollars. This demonstrates that it does motivate people but also that adding a 0 on to that would likely have a far larger impact on revenue than Nefarious Nigel and his evil plans.
- I think a large number of smart people would (rightly) be scared about taking the black market route, but are motivated when they know their isn't a legal risk. Or put differently the risk to reward ratio ("pot odds") becomes worth it for this value for legal prize.
Re: GitHub Security Bug Bounty
#7Isn't $5000 ridiculously low compared to the black market value of a GitHub exploit, or the time required to develop it? Assuming a company thinks it's pretty secure, putting real money on the line (the same money you'd normally pay an expert to pentest your system) would get some more prolific minds involved.
Bug bounties are rarely competitive with their black-market value. I think in most cases they're intended more as a "thanks!" than a "please don't hack us".
You're sort of just re-stating the question. I think everyone understands that's the way things are. The OP is saying that the way things are doesn't make much sense.
My guess is that the thinking goes something like this: White hats aren't going to hack us anyway, and will be fine with the tiny rewards we give them. So there's no reason to increase the rewards for them. Black hats probably aren't going to be dissuaded even by very high rewards, or perhaps even with high rewards they'd try to have their cake and eat it too, selling exploits first and then reporting them. Basically, they can't be trusted so trying to buy them off with a fair-market price isn't even worth it, so we may as well ignore them in our pricing strategy.
I don't know if that reasoning is correct, but I think approximates the thinking that leads to the status quo in this case.
Re: GitHub Security Bug Bounty
#8This looks great.
I especially like that they have 'rules for us' and also they have a section at the bottom which discusses discretionary bounties for their properties not covered in the main list.
Re: GitHub Security Bug Bounty
#9The one obvious flaw is the "email us for our PGP key" - distributing the public key in private and over an insecure channel makes it vulnerable to replacement.
Has anyone written a "best practices" guide for designing a security page ?
Re: GitHub Security Bug Bounty
#10So the Firefox UI is much like the Chrome UI minus border radius.