Hacker News Reader

...and now, all future holes in that site will be sold instead of reported to the owners.

I'm fine with that.

The problem is that this property transfers to other websites. I'd much rather a 16 year old report problems with my website to me, but if she doesn't because of fears that I will call the police as other webmasters have, I'm worse off as a result.

This is bad news for everyone who runs a website.

This highlights the importance of having a visible bug bounty program (or at least something very basic) that clearly states that you take security seriously and appreciate/reward (whatever you prefer) bug reports from security researchers.

This is why you should have a page describing your security reporting process.

> (1) Have a security contact, (2) publish a GPG key and accept GPG mail, (3) respond promptly with a "security flaw ID".

https://news.ycombinator.com/item?id=640367

It's a Government site, there's really no up-side to future issues being sold.

Reply on news.ycombinator.com