[flagged]
Vulnerability reports are not special anymore
241–249 of 249 posts
Re: Vulnerability reports are not special anymore
#242Yet again it's saying that AI can replace the job of an X. Take a hint people, if AI can't replace your job it can't replace anyone elses'.
Re: Vulnerability reports are not special anymore
#243Security through obscurity was never a great strategy.. and now it’s not a strategy at all.. Hopefully at the end of this decade, a ton of software practices have been overhauled to eliminate classes of problems. Memory-safe language use is a great start - but it’d be great to see innovation in checking for TOCTOU problems, improper/missing authn & authz, and many others. This is an engineering problem. It won’t be s…
At the end of the day security problems are just bugs like any other. If the resources to find them outweight their value then there is no sense in finding them (other than to give security researchers' jobs)
Re: Vulnerability reports are not special anymore
#244Security through obscurity was never a great strategy.. and now it’s not a strategy at all.. Hopefully at the end of this decade, a ton of software practices have been overhauled to eliminate classes of problems. Memory-safe language use is a great start - but it’d be great to see innovation in checking for TOCTOU problems, improper/missing authn & authz, and many others. This is an engineering problem. It won’t be s…
At the end of the day security problems are just bugs like any other. If the resources to find them outweight their value then there is no sense in finding them (other than to give security researchers' jobs)
I agree they’re bugs, but the impact being far greater should justify special treatment - and it does. You’ve got bug bounties, special access and even special devices for security researchers, if you count Apple’s program where they’ll let research be done on a special iphone.
The resources to find security bugs should be weighed against the impact of them being found & exploited by bad actors, not weighed against spending those resources on other things. (And small/simple products won’t suffer as much if a problem is found, so those cases justify smaller security investments)
Re: Vulnerability reports are not special anymore
#245Earlier quoted context omitted.
Because you are not providing any service not selling anything. There is no real way as a company to withhold someone’s money and that it goes through accounting. I am not an accountant so ask some accountants why not.
it's not illegal to ask people to send you money and then keep the money they send you
it is if you can’t explain it to tax authorities, especially if you are a business
Re: Vulnerability reports are not special anymore
#246Earlier quoted context omitted.
Did you make any attempt at tuning the prompt to reduce false positives? Or did you just say "find bugs"? Because if you tell it to do that, it will.
The point I was trying to make is that there will always be people reporting "critical" bugs.
Ok, that makes sense and it's a different point than I though you were making.
Re: Vulnerability reports are not special anymore
#247Earlier quoted context omitted.
That's a real issue, took cloudflare down once...
It's only a real issue if it is in runtime code that parses untrusted input. 99% of the regex lints/CVEs that get flagged our way are in build-time code.
I don't fully get you. Do you mean untrusted regex or untrusted data it operates on?
And to be honest, even if the regex is trusted (came from a developer) and the data as well (something predictable and structured) we are still not protected from the developer using extremely stupid regex and breaking everything
Re: Vulnerability reports are not special anymore
#248Earlier quoted context omitted.
Reminds me of someone (well known in their field) who charged $0.05 for using their “contact me” page. A trivial amount for someone who genuinely wanted to contact them, but just high enough to prevent any kind of scaled abuse
If I've stumbled across what I think is a security issue in your systems, there is zero chance that I'm going to get out my credit card and pay you for the privilege of responsibly disclosing it to you. Especially if it's the vulnerability is in the site hosting the contact form.
I don’t participate in bounties at all unless I believe there is a moral obligation or I’m set to make thousands of dollars. In each case, $0.05 is fine.
For a typical commercial entity? $0.05 is not a deterrent; the companies legal team is and has been for a decade.
Re: Vulnerability reports are not special anymore
#249Earlier quoted context omitted.
If I've stumbled across what I think is a security issue in your systems, there is zero chance that I'm going to get out my credit card and pay you for the privilege of responsibly disclosing it to you. Especially if it's the vulnerability is in the site hosting the contact form.
I don’t participate in bounties at all unless I believe there is a moral obligation or I’m set to make thousands of dollars. In each case, $0.05 is fine. For a typical commercial entity? $0.05 is not a deterrent; the companies legal team is and has been for a decade.
In most cases I'd think it's more of a deterrent for commercial entities, because spending money create complexity. Most employees are not in a position to just directly spend their organisation's money, so that $0.05 will often mean needing to get approval, purchase orders, deciding which cost centre it comes from, needing an invoice, etc, etc.
Very few people are going to invest that much effort when they're trying to do the company that they're reporting to a favour.