News for hackers. Stuff that matters.

A comment on Researcher banned on Valve's bug bounty program publishes second Steam 0-day. Parent comment

Re:Researcher banned on Valve's bug bounty program publishes... by tptacek on Wednesday August 21, 2019 @11:44PM (#20764460)
Among other reasons, because the site is literally stuffed to its gills full of people reporting bullshit security issues, like "user impersonation possible" (if you convince a user to open developer tools and give you their session cookie), and H1 wouldn't be doing any good if it generated a constant stream of people "WONTFIX-disclosing" those reports.
[ Parent | on HN ]
Re:Researcher banned on Valve's bug bounty program publishes... by shkkmo on Thursday August 22, 2019 @12:00AM (#20764514)
I don't quite follow this reasoning. Are you saying that by allowing people to make their NA / WONTFIX reports public, it will dilute the H1 brand? Does association with H1 have a significant effect of the perceived legitimacy of individual public disclosures? Why does this matter?

My presumption is that the "other reasons" are business/political and centered around the desire to provide value to or establish goodwill with corporate partners.

[ Parent | on HN ]
Re:Researcher banned on Valve's bug bounty program publishes... by tptacek on Thursday August 22, 2019 @12:12AM (#20764560)
People can publish whatever they want, and the only thing H1 can do about it is disinvite them from their platform. But anyone who suggests that H1 encourage people to publish NA/WONTFIX bugs probably hasn't had much contact with H1 bounty reports.

In reality, valid bugs being quashed by vendors is not the real problem H1 has.

[ Parent | on HN ]
Re:Researcher banned on Valve's bug bounty program publishes... by shkkmo on Thursday August 22, 2019 @12:22AM (#20764618)
I would rather suggest that H1 discourage (or even prohibit) their partners from dis-inviting reporters for publicizing NA/WONTFIX bugs.

In this particular case, is sounds like H1 (or an employee thereof) actively discouraged disclosure, which seems like a problem.

> In reality, valid bugs being quashed by vendors is not the real problem H1 has.

There can clearly be more than one problem. I still fail to see the relevance of the "bug report quality" problem to this discussion (beyond explaining why automatic disclosure of NA/WONTFIX reports is not helpful.)

[ Parent | on HN ]