Hacker News Reader

Self service security bounties seems like a very smart idea.

Would self-service security bounties enable a distributed bounty ? where each site developer puts a relatively small bounty in his site and his bounty offers him a certain qualification in the eyes of customers , but from the hacker standpoint , if you hacked one , you hacked them all and hence you can collect multiple bounties ?

View on HN

Isn't that pretty much what we have already with things like openSSL? Find an exploit and suddenly you've exposed everyone. I don't think public bounties would change any of the dynamics around this situation.

With the current system, if you're using an exploit(especially for gain), you're a criminal.Not so when using pinata.

Also , pinata exposes all hacks in public, unlike today.

My point is that I don't believe any of the dynamics would actually change. White hats would still report issues (they're not necessarily doing it for the money) and nefarious types will still trade/sell exploits.

Reply on news.ycombinator.com