Shopify has paid over $300k in security exploit bounties
1–10 of 80 posts
Re: Shopify has paid over $300k in security exploit bounties
#2This bug bounty program was limited to MRuby and paid by Shopify. Does anyone know where they use MRuby in their stack?
Re: Shopify has paid over $300k in security exploit bounties
#3we expect most vulnerabilities will no longer be exploitable without additional bugs in the kernel or seccomp itself, and so we are lowering the payout amounts for our program to 10% of previous levels.
I don't quite follow this logic. If bugs are now going to be more difficult to find, one would think they would be more valuable, not less.. and that by lowering the bounties they are lowering the incentive for people to search for them.
Re: Shopify has paid over $300k in security exploit bounties
#4we expect most vulnerabilities will no longer be exploitable without additional bugs in the kernel or seccomp itself, and so we are lowering the payout amounts for our program to 10% of previous levels. I don't quite follow this logic. If bugs are now going to be more difficult to find, one would think they would be more valuable, not less.. and that by lowering the bounties they are lowering the incentive for people…
I suppose because the vulnerabilities would actually be vulnerabilities in someone else's code they don't feel it should come under their umbrella?
Re: Shopify has paid over $300k in security exploit bounties
#5This bug bounty program was limited to MRuby and paid by Shopify. Does anyone know where they use MRuby in their stack?
From [1]:
>> The Script Editor app lets you create scripts that are run each time a customer adds items to their cart. Shopify Scripts can have many uses, from discounting products with specific tags to running promotions such as "buy 2, get 1 free". Shopify Scripts are written with a Ruby API that allows a great deal of control and flexibility.
The description on the bug bounty page says those 'Shopify Scripts' are executed in an MRuby environment, which they are trying to keep sandboxed.
Re: Shopify has paid over $300k in security exploit bounties
#6"It looks like your JavaScript is disabled. To use Hacker One, enable JavaScript in your browser and refresh this page."
Kinda ironic that a site that is supposedly for hackers wants you to expose yourself to zillion browser vulnerabilities before you can see its content.
Re: Shopify has paid over $300k in security exploit bounties
#7Shopify seems to basically have given up on application-level sandboxing, and now relies on process-level sandboxing (e.g. seccomp).
This is probably wise; the track record of in-language sandboxing is pretty bad (see also: Java applets.)
Re: Shopify has paid over $300k in security exploit bounties
#8we expect most vulnerabilities will no longer be exploitable without additional bugs in the kernel or seccomp itself, and so we are lowering the payout amounts for our program to 10% of previous levels. I don't quite follow this logic. If bugs are now going to be more difficult to find, one would think they would be more valuable, not less.. and that by lowering the bounties they are lowering the incentive for people…
I suppose because the vulnerabilities would actually be vulnerabilities in someone else's code they don't feel it should come under their umbrella?
That's flawed reasoning IMO. Do they expect the underlying porject maintainers to have the same resources they do to compensate third party vulnerability research?
It really should be the other way around, public facing, revenue generating projects should do all they can to subsidise vulnerability research and upstream their findings. The alternative would be to start paying up more for the code they use from third party and what are the odds of that.
Re: Shopify has paid over $300k in security exploit bounties
#9Earlier quoted context omitted.
I suppose because the vulnerabilities would actually be vulnerabilities in someone else's code they don't feel it should come under their umbrella?
That's flawed reasoning IMO. Do they expect the underlying porject maintainers to have the same resources they do to compensate third party vulnerability research? It really should be the other way around, public facing, revenue generating projects should do all they can to subsidise vulnerability research and upstream their findings. The alternative would be to start paying up more for the code they use from third p…
Doesn't this assume that as each bug in MRuby becomes more difficult to find, they're also more severe? Couldn't it instead be the opposite, that each bug is less severe because all of the serious ones have been closed?
Re: Shopify has paid over $300k in security exploit bounties
#10Earlier quoted context omitted.
I suppose because the vulnerabilities would actually be vulnerabilities in someone else's code they don't feel it should come under their umbrella?
That's flawed reasoning IMO. Do they expect the underlying porject maintainers to have the same resources they do to compensate third party vulnerability research? It really should be the other way around, public facing, revenue generating projects should do all they can to subsidise vulnerability research and upstream their findings. The alternative would be to start paying up more for the code they use from third p…
With those lower 'underlying project' bugs there are multiple actors who can compensate for vulnerability research, so the market rate goes down.
It makes sense to either: lower the payout to reflect market rate or start a seperate scheme for those projects that others can buy into. Unfortunately if you use a seperate scheme you end up paying for bugs that don't affect you.
Personally I'd have split my own payouts into things from my own project (100%) and things from other projects (10%).
The fact they haven't done this suggests to me that they consider the bounty system too expensive - either in payouts or maintenance. By reducing payouts you will likely reduce interest and increase signal to noise at the cost of less signal.