Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found Prezi's source code

blog.shubh.am

Post reply on HN
Print view View original

201–210 of 266 posts

Re: I found Prezi's source code

#201

Post by droopybuns »

RyanZAG wrote: post #90
toddmorey wrote: post #53

Why even have a limited scope on bounty programs? (This is not the only time I've seen that.) Is it only to limit payout? Are their legal reasons? For example, their client tablet applications are ineligible. I just don't get the reasoning. In their position, I'd pay him the $500 and remove the idea of scope. I'm just curious if there's some counter-argument I'm not thinking about.

Having these kinds of rules on bug bounty programs is excellent for hackers though. If I wanted to hack Prezi I now have a lot of very useful information. 1) Prezi is not interested in blocking access to people who already have the ID of the presentation. This is good news since it means I can enumerate the IDs and get access to private presentations - some of which could have useful private data. 2) Prezi is not int…

I want to address your edit:

I think your post also shows a very large misconception in the disclosure world.

It sounds like you're saying that bug bounties should be a free-for-all.

Are you recognizing that these companies often already have security programs in place? Do you also concede that the companies may already be aware of where their vulnerabilities rest?

Large organizations know things that you don't when you're submitting bugs to a reward program. Constraints on a program help them focus on areas where they know they have unknowns. It also helps them deal with situations where they know fixes are scheduled, but not currently implemented.

How are things going to play out if you took the time to discover a bug and the company told you they're not going to pay for it because they already know about it and already have a fix scheduled?

The average 'researcher' is going to be pissed. You don't know if they're telling the truth, you put in your valuable time into finding the bug, and you're wondering why you should put in your time next time.

Rules on a bug bounty program do not necessarily exist to constrain the reporters to only the "known strong areas". They're there to help avoid situations that might lead them to quite reasonably ask why they bothered to try to do a responsible disclosure in the first place.

Re: I found Prezi's source code

#202

Post by d0m »

One trick to avoid stupidities like this is to tell them what you found, but not how.

How much is worth the vulnerability of having access to all your source code. Just ping me if you're interested.

Re: I found Prezi's source code

#204

Post by tlrobinson »

toddmorey wrote: post #53

Why even have a limited scope on bounty programs? (This is not the only time I've seen that.) Is it only to limit payout? Are their legal reasons? For example, their client tablet applications are ineligible. I just don't get the reasoning. In their position, I'd pay him the $500 and remove the idea of scope. I'm just curious if there's some counter-argument I'm not thinking about.

The only reason I see is if you provide immunity in exchange for following the rules you don't want to allow actions that can degrade your service like DDoSing, online brute forcing, vulnerability scanners, etc.

That doesn't really apply in this case though.

Re: I found Prezi's source code

#205

Post by prawn »

Don't worry about the bounty, here, have swag that freely advertises our company. Weak. Why should anyone put up with that?

Pay him something outside the bug bounty program. Easy and cheap solution that could've avoided all this mess.

Re: I found Prezi's source code

#206

Post by kstop »

danielweber wrote: post #195
woodchuck64 wrote: post #182

Earlier quoted context omitted.

"Now I think Prezi should probably have paid him anyway because that's a pretty boneheaded error and I'd be very grateful if someone politely pointed it out to me" But Shubham did one additional thing, he unintentionally embarrassed a founder. That's the real reason he's not getting paid, everything else is a technicality...

Good life lesson: don't be a dick.

A dick would have stuck it up on Pastebin or wherever it is the kids stick things these days.

Re: I found Prezi's source code

#207

Post by mendicantB »

Ensorceled wrote: post #144
[deleted] wrote: post #116

Earlier quoted context omitted.

[deleted]

You should stop talking and you were smart to delete that other comment. I was wondering about what truly happened but now I get the impression that Prezi is officious and bureaucratic and I wonder what kind of customer support such an organization would offer: "Our Terms of Service say we are not responsible for your lost data. Have a nice day and here's a T-Shirt."

Looks like he took your advice. Regardless, I still got the same impression you did.

Re: I found Prezi's source code

#208

Post by halacsy »

I'm hp co-founder and CTO of prezi. We learn from our mistakes, we have changed the program: To improve the program from now on we will reward bug hunters who find bugs outside of the scope provided that they do not violate our users’ information and that their report triggers us to improve our code base. We will also retroactively check to see if other reports found issues that fall into this category. More info at engineering.prezi.com/blog/2013/12/03/a-bug-in-the-bugbounty/

Re: I found Prezi's source code

#210

Post by phaed »

mimog wrote: post #125
ollysb wrote: post #58

Earlier quoted context omitted.

If you look inside those compiled jar files you'll find that the code is pretty easy to read. It's certainly enough to find vulnerabilities.

But.. that can be said about any java (jar) programs class files. It is also not difficult to decipher the asm of a disassembled exe file, but to equate that with finding the source code of the program would be disingenuous.

You can drag drop that jar file into http://jd.benow.ca/ and in two clicks you have 100% of the source code, variable names and all. It's not the same as decompiling an C executable by any means.
Post reply on HN