Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meet the bughunters: the hackers in India protecting your data

theguardian.com

Post reply on HN
Print view View original

11–17 of 17 posts

Re: Meet the bughunters: the hackers in India protecting your data

#11

Post by hntuesday »

nxzero wrote: post #2

Amazing that all publicly traded companies are not by law required to have bug bounties. Same goes for any major open source project too.

Nobody should have to offer bounties. Researchers should not expect to get paid for their unsolicited work.

We probably agree that vulnerability reports should be seen as a positive thing. What software owners should have are policies and procedures for transparently handling vulnerability disclosures. At most, I think having some flexible process should be required as part of a certification (PCI, etc).

I do think that knowledge of a vulnerability and lack of action to fix it in a reasonable amount of time, which results in a breach should be treated more seriously. At the same time, encouraging reports of breaches is hard as it is and introducing more punishment would make everyone want to just keep quiet or as ambiguous as possible. I'm not sure what a good solution to this would be.

Re: Meet the bughunters: the hackers in India protecting your data

#12

Post by zhte415 »

OJFord wrote: post #8

> rupee millionaire I don't wish to put down Mr Prakash's achievements, but is that actually a celebrated figure in India - or at ~£10.6k is the word 'millionaire' just a sensationalism for our benefit?

~£10.6k is an OK figure in India, but depends where you are and what you do.

In an international company, doing UAT type testing and investigation, it would be about average for an assistant manager, but the variance is vast, even between people sitting next to each other.

If that figure is per month, then he's really doing well, pulling in the same as an SVP in an international company managing a team doing a similar role.

Re: Meet the bughunters: the hackers in India protecting your data

#13

Post by zhte415 »

nxzero wrote: post #2

Amazing that all publicly traded companies are not by law required to have bug bounties. Same goes for any major open source project too.

Publicly traded companies are required to face fines for negligence, for information leaks, fraud, or other. As are all companies.

If they choose bug bounties to help with this, good for them. If they choose other measures, also good too. They simply need to show they take effort to protect information as dictated by information security laws, or internal policy, whichever is stricter.

Re: Meet the bughunters: the hackers in India protecting your data

#14

Post by cmdrfred »

hntuesday wrote: post #11
nxzero wrote: post #2

Amazing that all publicly traded companies are not by law required to have bug bounties. Same goes for any major open source project too.

Nobody should have to offer bounties. Researchers should not expect to get paid for their unsolicited work. We probably agree that vulnerability reports should be seen as a positive thing. What software owners should have are policies and procedures for transparently handling vulnerability disclosures. At most, I think having some flexible process should be required as part of a certification (PCI, etc). I do think t…

> Nobody should have to offer bounties. Researchers should not expect to get paid for their unsolicited work.

The Chinese and Russian exploit markets don't seem to care if the work was solicited or not.

Re: Meet the bughunters: the hackers in India protecting your data

#15

Post by nxzero »

ugexe wrote: post #10
nxzero wrote: post #4

Earlier quoted context omitted.

Just even having a page, with a small bounty, and a secure means of submitting a exploitable bug. If you want to dig deeper, I'd contact professional bug hunters and ask them how to insure that the value on the bug matches the reward.

And if you can't afford to pay a bounty just don't write software right? Don't you think it's odd your answer to what you are replying to is "I have no idea, ask someone who knows" yet you feel compelled to weigh in on who should not be allowed to write/distribute software?

Unclear why you believe that a major software project would not be able to find a sponsor for a bug bounty; in fact, many major projects already have bug bounty sponsors.

Also, why would it be strange to suggest talking to someone other than myself?

Re: Meet the bughunters: the hackers in India protecting your data

#16

Post by OJFord »

zhte415 wrote: post #12
OJFord wrote: post #8

> rupee millionaire I don't wish to put down Mr Prakash's achievements, but is that actually a celebrated figure in India - or at ~£10.6k is the word 'millionaire' just a sensationalism for our benefit?

~£10.6k is an OK figure in India, but depends where you are and what you do. In an international company, doing UAT type testing and investigation, it would be about average for an assistant manager, but the variance is vast, even between people sitting next to each other. If that figure is per month, then he's really doing well, pulling in the same as an SVP in an international company managing a team doing a simila…

Right, he's doing well but it seems odd to say to a predominantly British audience that he's a "multi-millionaire [in rupees]", when actually the implication of that is 'hugely successful, doesn't need to work', rather than 'successfully self-employed/running his own business'.

Congratulations and all the best to him, of course, I just think it's a misleadingly sensationalised subtitle.

Re: Meet the bughunters: the hackers in India protecting your data

#17

Post by kevin_thibedeau »

zhte415 wrote: post #13
nxzero wrote: post #2

Amazing that all publicly traded companies are not by law required to have bug bounties. Same goes for any major open source project too.

Publicly traded companies are required to face fines for negligence, for information leaks, fraud, or other. As are all companies. If they choose bug bounties to help with this, good for them. If they choose other measures, also good too. They simply need to show they take effort to protect information as dictated by information security laws, or internal policy, whichever is stricter.

Maybe in Euro-land. In the US companies with data breaches are the hapless victims of those nasty hacker types. You wouldn't want to blame the victim would you? Never mind that they have a column of plaintext passwords in a web accessible server.
Post reply on HN