News for hackers. Stuff that matters.

A comment on Identify a Facebook user by his phone number despite privacy settings set. Parent comment

Re:Identify a Facebook user by his phone number despite priv... by aliyfarah on Tuesday May 18, 2021 @12:47AM (#27191348)
"Paying out at a rate competitive with malicious actors makes it a market and would incentivise bounty hunting. It would be a perverse incentive"

I don't get this. What's wrong with incentevizing bounty hunting? Isn't the whole point of bounties to provide an incentive to the public to find & report bugs?

Personally, if I found a bug that had a market, it's going to the highest (legal) bidder. Be it Mossad, Facebook or Mr. Bone Saw's personal security team. Bug hunting is a professional service not a humanitarian one.

[ Parent | on HN ]
Re:Identify a Facebook user by his phone number despite priv... by CamperBob2 on Tuesday May 18, 2021 @02:23AM (#27191767)
Once, a large city had a rat problem. The pests were everywhere, and none of the usual measures seemed to eradicate them. So the mayor posted a bounty on rats. For every dead rat turned in, the city would pay $5.

This strategy (although certainly better-intentioned) failed for the same reason your proposal would fail.

[ Parent | on HN ]
Re:Identify a Facebook user by his phone number despite priv... by Closi on Tuesday May 18, 2021 @02:33AM (#27191823)
I’m not sure I get what you mean - I assume you are referencing the fictional tale of the pied piper of hamlet where the pied piper cleared the hamlet of rats by playing a pipe and leading them to a river, but then the mayor refused to pay because he incorrectly claimed the pied piper brought the rats in from another town, so then in retaliation the pied piper kidnapped all the children and they are never seen again?

What’s the similarity here? I’m not entirely sure a fairy tale disproves OPs argument, particularly when the circumstances are so different (you can’t bring in bugs from another app, facebook has a history of paying up and the bounty fees are tiny for them).

[ Parent | on HN ]
Re:Identify a Facebook user by his phone number despite priv... by moconnor on Tuesday May 18, 2021 @02:56AM (#27191924)
Probably suggesting people would start rat farms. Paying large bounties for bugs incentivises developers to introduce bugs for their “friends” to find.

To some extent this dynamic must already exist, which is a troubling thought.

[ Parent | on HN ]
Re:Identify a Facebook user by his phone number despite priv... by Closi on Tuesday May 18, 2021 @06:16AM (#27192929)
> To some extent this dynamic must already exist, which is a troubling thought.

I've not seen any evidence for this behaviour existing, even with Microsoft Bug Bounties of up to $250,000, or even heard of developers being tempted to introduce bugs for friends to find them.

I assume the bigger risk is developers intentionally introduce bugs for nefarious purposes (i.e. black market sale), rather than to win a bug bounty.

[ Parent | on HN ]
Re:Identify a Facebook user by his phone number despite priv... by grenoire on Tuesday May 18, 2021 @03:34AM (#27192102)
The analogy makes no sense considering there's no way for people to create bugs (unless they're within Facebook, hah) to farm bounties for.
[ Parent | on HN ]
Re:Identify a Facebook user by his phone number despite priv... by mannerheim on Tuesday May 18, 2021 @03:56AM (#27192213)
That seems to be the implication, but that seems pretty unlikely because of the risk. If the bounty were, say, 100k, is anyone going to risk a 200k salary over letting a friend of theirs get that bounty? And if you try pulling that off more than once, that's just begging to be caught.
[ Parent | on HN ]