News for hackers. Stuff that matters.

A comment on Security.txt. Parent comment

Re:Security.txt by selfhoster11 on Sunday March 14, 2021 @07:44PM (#26460745)
I'd never enter in a paid interaction without some sort of escrow that will make sure I'm not screwed over for the crime of being a good citizen. The victim could just keep the cost of the report without ever refunding. Innocent people will keep getting caught by this even long after the company acquires a reputation for never providing refunds.
[ Parent | on HN ]
Re:Security.txt by aasasd on Sunday March 14, 2021 @11:24PM (#26462307)
Since the escrow sees your report, it sounds like HackerOne.

HO will just create paid tiers where for a smallish subscription price, people actually take your reports seriously.

[ Parent | on HN ]
Re:Security.txt by 67868018 on Monday March 15, 2021 @11:36AM (#26467226)
Smart contracts on Ethereum blockchain... force them to set a date to pay you and go public. They can't back out.

Going to need a lot of work in the next few years to make something like this viable, but ETH could make it possible

[ Parent | on HN ]
Re:Security.txt by aasasd on Monday March 15, 2021 @05:41PM (#26469523)
Are you saying that Eth can somehow withhold info until a future time when it automatically becomes public? How would that work?
[ Parent | on HN ]
Re:Security.txt by 67868018 on Thursday March 18, 2021 @07:38AM (#26501617)
Ethereum has a Turing complete programming language inside
[ Parent | on HN ]
Re:Security.txt by aasasd on Saturday March 20, 2021 @11:47AM (#26523927)
Yeah so? Think about it. How do you make a blob of data unreadable by people on Thursday but readable on Friday? You can't do it without a trusted third-party.

If Eth has a solution for this, it would mean it basically solves trust in general, which is a persistent pain in all of infosec.

[ Parent | on HN ]