Inside Patreon, the economic engine of internet culture

Re:Inside Patreon, the economic engine of internet culture by makomk on Thursday August 03, 2017 @03:09PM (#14922734)

Probably also why they still haven't fixed their handling of security reports since they left everyone's personal information on a system with a web-accessible root Python shell for over a week after being warned about said hole, and it inevitably got hacked and leaked all over the Internet. (A researcher was complaining about not being able to report a serious issue a couple of days ago.) As long as everything's centralised on Patreon and there are no meaningful alternatives there's no reason for them to care. After all, what are people going to do? For ordinary people, Patreon is where all the artists and content are; for artists it's where all the poeple funding them are.

[ Parent | on HN ]

Re:Inside Patreon, the economic engine of internet culture by seanie_patreon on Thursday August 03, 2017 @06:25PM (#14924513)

Hi,

I'm a security engineer at Patreon. Like most companies we take security reports from folks via [email protected] and [email protected]. The dedicated security email is the quickest route to the security team.

We also have an invite only HackerOne program where we've invited the top reporters on HackerOne. When folks send us a valid report via email we also add them to our HackerOne program for reward (we've paid out >$17,000 to security researchers to date). As with any developing bug bounty program we're still improving it and we plan to open up our HackerOne program soon.

[ Parent | on HN ]

Re:Inside Patreon, the economic engine of internet culture by makomk on Thursday August 03, 2017 @09:04PM (#14925527)

While that's good to know, it's not me you should be telling this to now, it's this guy a few days ago: https://twitter.com/DMDeck16/status/889156464891371520 https://twitter.com/DMDeck16/status/890188665389010945

[ Parent | on HN ]

Re:Inside Patreon, the economic engine of internet culture by Aeolun on Friday August 04, 2017 @01:13AM (#14926469)

I dunno, it took me all of 20 seconds to go to their FAQ page and find the reporting email address for security issues (https://patreon.zendesk.com/hc/en-us/articles/115003872306-S...).

If this guy has been screaming into the void on Twitter waiting for an email address, then the problem is probably that he's using twitter.

[ Parent | on HN ]