SoylentNews is people
SoylentNews
Arthur T Knackerbracket has found the following story:
Used properly, bug bounty platforms connect security researchers with organizations wanting extra scrutiny. In exchange for reporting a security flaw, the researcher receives payment (a bounty) as a thank you for doing the right thing. However, CSO's investigation shows that the bug bounty platforms have turned bug reporting and disclosure on its head, what multiple expert sources, including HackerOne's former chief policy officer, Katie Moussouris, call a "perversion."
Silence is the commodity the market appears to be demanding, and the bug bounty platforms have pivoted to sell what willing buyers want to pay for.
"Bug bounties are best when transparent and open. The more you try to close them down and place NDAs on them, the less effective they are, the more they become about marketing rather than security," Robert Graham of Errata Security tells CSO.
Leitschuh, the Zoom bug finder, agrees. "This is part of the problem with the bug bounty platforms as they are right now. They aren't holding companies to a 90-day disclosure deadline," he says. "A lot of these programs are structured on this idea of non-disclosure. What I end up feeling like is that they are trying to buy researcher silence."
(Score: 2) by Immerman on Wednesday April 08 2020, @01:46AM (1 child)
I don't believe those in any way bind the actions of the third part though. I can absolutely be the *beneficiary* of a contract between other people, and presumably even have certain obligations in order to claim that benefit. But I'm pretty certain a contract I didn't sign (or otherwise agree too - EULA's exist in a weird grey area of implied consent) can't legally obligate me to act (or not act) in any particular manner, it can only try to lure me into doing so.
(Score: 0) by Anonymous Coward on Thursday April 09 2020, @02:50AM
Sure they can. For example, I give you a N.I., which is a contract between myself and you that makes it such that a third-party, usually but not always a bank, has to pay you. Or I sign an agreement and use my house as collateral and then sell it, the buyer has to GTFO if the agreement is foreclosed on. Or I agree to mow my backyard weekly and not construct a fence in exchange for everyone else on my block agreeing to do the same so that way we can all use the common backyard area, which binds not only myself but everyone else who may own my property whether they know about the agreement or not. Or I duly delegate and assign a contract to another with proper notice, which binds the third parties to the respective contracts to act as though the agreements were originally between the two of them and cut me out.