I Got Paid $0 from the Uber Security Bug Bounty

Re:I Got Paid $0 from the Uber Security Bug Bounty by michaelt on Sunday December 24, 2017 @04:26PM (#16001369)

  it doesn't make sense for
  Uber to a) publish a list 
  of current unpatched 
  security vulnerabilities

Hackerone could require them to publish a list of hashes of unambiguous descriptions of known bugs. That way they could prove beyond doubt which issues were already known - much like astronomers published anagrams to prove their discoveries' priority in the 1500s.

It wouldn't solve the problem of people wasting their time rediscovering bugs that don't pay out, of course.

[ Parent | on HN ]

Re:I Got Paid $0 from the Uber Security Bug Bounty by tomxor on Sunday December 24, 2017 @05:21PM (#16001612)

I was going to suggest hackerone should be responsible for both storing and arbitrating known bugs but this is even better.

It's really hard to not think Uber is simply playing hackerone to get free penetration testing here by responding to everything as "already discovered" or "out of scope"... A dangerous game though if people catch on and get pissed off enough and just publish it like this, I can't really blame the author, the whole process sounds like bullshit.

[ Parent | on HN ]

Re:I Got Paid $0 from the Uber Security Bug Bounty by zipwitch on Sunday December 24, 2017 @06:09PM (#16001778)

This would appear to be consistent with what I've personally observed of Uber's approach to, well, pretty much everything.

[ Parent | on HN ]

Re:I Got Paid $0 from the Uber Security Bug Bounty by technion on Monday December 25, 2017 @01:48AM (#16003061)

I think it would go a long way just stating when they became duplicates. It would be hard to be mad at Uber if another person reported the same bug two days earlier.

It would be easy to be mad at Uber if this had been sitting in an internal bug tracker for three years just getting "closed, duplicate" everytime someone made a Hacker One report.

[ Parent | on HN ]