News for hackers. Stuff that matters.

A comment on Remote Code Execution in Slack desktop apps. Parent comment

Re:Remote Code Execution in Slack desktop apps by jansommer on Saturday August 29, 2020 @09:44AM (#24316049)
Damn, didn't know $1750 was low. I got something similar for reporting an exploit to Microsoft, where opening an attached ICS/calendar entry in Outlooks web client allowed me to execute arbitrary JavaScript on outlook.microsoft.com as the current user. Should have asked for more!
[ Parent | on HN ]
Re:Remote Code Execution in Slack desktop apps by tptacek on Saturday August 29, 2020 @12:52PM (#24317432)
It sounds like you got $1750 for an XSS-equivalent attack. That's high for XSS.
[ Parent | on HN ]
Re:Remote Code Execution in Slack desktop apps by ianhawes on Saturday August 29, 2020 @10:37AM (#24316386)
Yes... yes you should have.
[ Parent | on HN ]
Re:Remote Code Execution in Slack desktop apps by dQw4w9WgXcQ on Saturday August 29, 2020 @12:18PM (#24317159)
I wouldn't beat yourself up over it. There's probably room to develop an exploit valuation model that better helps to translate (time spent on research) + (X% of business/customer impact), where X is a pretty low figure, otherwise companies would never stay in business.

Don't undervalue the intangible permanence of doing the right thing, character outlasts cash come the grave.

[ Parent | on HN ]