It’s a good platform, but it really doesn’t solve the time-sink problem, even if you pay for triage services. Triage can knock down well-known patterns of bogus stuff, but so can you; the real problem is the truly wacky stuff people come up with.
Re:Security.txt
by fractionalhare on Sunday March 14, 2021 @10:25PM
(#26461951)
I can see and read the JavaScript source code if I intercept the requests! Please pay me $100.
Re:Security.txt
by marco_craveiro on Friday March 19, 2021 @06:40AM
(#26511844)
Hi @fractionalhare, apologies for the spam but I am trying to read a post you made a few months ago on implementing Exp [1] but it seems the site is down. Is there a different source perhaps? Many thanks for your time.
Re:Security.txt
by selfhoster11 on Sunday March 14, 2021 @07:44PM
(#26460745)
I'd never enter in a paid interaction without some sort of escrow that will make sure I'm not screwed over for the crime of being a good citizen. The victim could just keep the cost of the report without ever refunding. Innocent people will keep getting caught by this even long after the company acquires a reputation for never providing refunds.
Since the escrow sees your report, it sounds like HackerOne.
HO will just create paid tiers where for a smallish subscription price, people actually take your reports seriously.
Smart contracts on Ethereum blockchain... force them to set a date to pay you and go public. They can't back out.
Going to need a lot of work in the next few years to make something like this viable, but ETH could make it possible
Are you saying that Eth can somehow withhold info until a future time when it automatically becomes public? How would that work?
Ethereum has a Turing complete programming language inside
Yeah so? Think about it. How do you make a blob of data unreadable by people on Thursday but readable on Friday? You can't do it without a trusted third-party.
If Eth has a solution for this, it would mean it basically solves trust in general, which is a persistent pain in all of infosec.
The fact that the industry currently needs this kind of solution is absurdly comedic. Basically, it would make actual sense to require people to pay ten bucks when posting a report—if they think the report is reasonable and that they would get paid for it.