Hacker News Reader

Comment by michaelt | Hacker News Reader

  it doesn't make sense for
  Uber to a) publish a list 
  of current unpatched 
  security vulnerabilities

Hackerone could require them to publish a list of hashes of unambiguous descriptions of known bugs. That way they could prove beyond doubt which issues were already known - much like astronomers published anagrams to prove their discoveries' priority in the 1500s.

It wouldn't solve the problem of people wasting their time rediscovering bugs that don't pay out, of course.

View on HN

I was going to suggest hackerone should be responsible for both storing and arbitrating known bugs but this is even better.

It's really hard to not think Uber is simply playing hackerone to get free penetration testing here by responding to everything as "already discovered" or "out of scope"... A dangerous game though if people catch on and get pissed off enough and just publish it like this, I can't really blame the author, the whole process sounds like bullshit.

This would appear to be consistent with what I've personally observed of Uber's approach to, well, pretty much everything.

I think it would go a long way just stating when they became duplicates. It would be hard to be mad at Uber if another person reported the same bug two days earlier.

It would be easy to be mad at Uber if this had been sitting in an internal bug tracker for three years just getting "closed, duplicate" everytime someone made a Hacker One report.

Reply on news.ycombinator.com