Hacker News Reader

Comment by disease | Hacker News Reader

Give the person a small reward for pointing out the vulnerability and offer another small reward for suggesting how to fix it.

View on HN

Maybe hire that person?

Hire someone because they exploited a single vulnerability?

I've heard of much worse hiring practices than to base on a single display of competence.

In the late nineties/early aughts, I worked for a company that hired a pair of guys after those guys showed up holding basically all the data from one of the company's services. The company started using these guys' custom software instead.

The server running this software was in our main server room although it was technically not our department. So one day, when a fairly serious bug was found, I had to chaperone the non-technical person into the service room. She was on the phone with these guys. For political reasons within the company, all I could do was watch. They instructed her, over the phone, symbol-and-letter by symbol-and-letter to add to live production code. What they added? A giant "if false" block around the buggy code.

True. Then again, I've heard of many better hiring practices as well.

Even odds it's a current employee, anyway.

God forbid. No hire if they cannot reverse binary tree on the whiteboard using angular react e6.

The guy that couldn't "reverse a binary tree" came from a team that turned out to be incompetent (in operations field; they didn't see anything wrong with distributing all the packages with software using HTTP without SSL/TLS nor any cryptographic signature).

Are we talking about Homebrew guy? Was this a flaw in Homebrew or something else he worked on?

Yes, the one. It was (is? don't know, I don't use Apple products) a flaw in how Homebrew and its homepage operates.

Didn't they fix it?

As I remember, they argued that this is perfectly fine and there's totally no problem with that.

To be fair, some major Linux distros also distribute using http e.g. go to https://www.debian.org/ and check the Download link at the top of the page: it is http.

Yes, but there are some important differences:

- Debian provides SHA-512 checksums of those ISO images

- the checksums are signed cryptographically

- web server is not the only distribution point

- Debian packages are distributed signed, so once you have your OS installer somehow verified, you're much safer than with Homebrew

Granted, SHA-512 checksums and their GPG signatures are not exposed very prominently on Debian's homepage. You need to go to the listing of directory with ISO instead of clicking "download ISO" direct link.

Maybe offering a reward is a good way to reduce the anonymity of the person, since rewards can be tracked.

Speaking only for myself.. If I were to go the trouble to anonymously tip somebody off about a security vulnerability, it would be because I cared that they were secure and that I did not wish to be identified. I would neither expect nor accept a reward.

Yes but a white hat like you would probably give at least some hints on how to fix it or what vulnerability you have discovered, not just a screenshot showing that you have/had access.

I think just the fact that they didn't do this points to malevolence. I would expect the ransom demands to follow shortly.

why small ? the reward should be in accordance with the criticity IMHO.

So a startup with 100k total funding got messaged a major company crushing bug. What should they offer for such a big find, 50k? Half their runway?

It's not that rewards should be small for big finds, but if you are legit poor, you have limits on what you can do.

Rewards should always be in accordance with made-up words IMHO.

Reply on news.ycombinator.com