News for hackers. Stuff that matters.

A comment on Kim Dotcom puts up €10,000 bounty for first person to break Mega's security. Parent comment

Re:Kim Dotcom puts up €10,000 bounty for first person to bre... by dpeck on Friday February 01, 2013 @04:25AM (#5149963)
It doesn't really work that way in practice. I believe bounty programs are good, but they aren't a replacement for an actual security team.

Its one of those things that doesn't scale all that well, one really talented tester can gain a deep understanding of an app and find loads and loads of opportunities for attack. Most bounty bug hunters on the other hand are hard to distinguish from usual internet background noise.

Veracode recently put up an infograpic on bounty programs that was kind of interesting, http://www.veracode.com/blog/2013/01/can-bug-hunters-keep-th...

[ Parent | on HN ]
Re:Kim Dotcom puts up €10,000 bounty for first person to bre... by incision on Friday February 01, 2013 @11:43AM (#5151778)
>I believe bounty programs are good, but they aren't a replacement for an actual security team.

Of course not, I don't mean to suggest that it is. I'm suggesting that this is marketing with potential for cheap labor more than a real commitment to security.

[ Parent | on HN ]