News for hackers. Stuff that matters.

A comment on Mastercard DNS Error Went Unnoticed for Years. Parent comment

Re:Mastercard DNS Error Went Unnoticed for Years by sdwr on Wednesday January 22, 2025 @05:09PM (#42798054)
If the reporter is trying to get paid for not reporting, that's blackmail. If the blackmail is organized, it's a racket.

Plus, if the attack surface is huge and/or fractal, you will never run out of exploits. The more you pay people to find them, the harder they look...

[ Parent | on HN ]
Re:Mastercard DNS Error Went Unnoticed for Years by taatof on Wednesday January 22, 2025 @06:15PM (#42798543)
> If the reporter is trying to get paid for not reporting, that's blackmail.

That's not what happened here and isn't usually what happens, though? The reporter usually gives a timeline for fixing the bug before reporting externally, and often extends that deadline if it's clear the Company is working on it. This is separate from bug bounty payments.

> The more you pay people to find them, the harder they look...

Yeah... that's the point...

[ Parent | on HN ]
Re:Mastercard DNS Error Went Unnoticed for Years by lodovic on Thursday January 23, 2025 @01:33AM (#42801289)
People will look for bugs regardless, better incentivize them to report to you first
[ Parent | on HN ]