Re:How we got read access on Google’s production servers
by eric_cc on Friday April 11, 2014 @06:08PM
(#7575883)
So you pay money to hire somebody to send a company a letter informing the company of the companies problem in hopes that maybe, just maybe, the company will reward the the firm a small sum of money and you will get a small amount back.
I think you have a winner on your hands.
Re:How we got read access on Google’s production servers
by ithkuil on Sunday April 13, 2014 @08:05AM
(#7581061)
I might be living in a country with very few banks (3). I may benefit from letting them know about a security issue, especially if because of that issue I could potentially go to jail
I may not have the option of changing bank because the others are even worse.
however I don't know how much I would pay for that. Probably some kind of class action would work.
Re:How we got read access on Google’s production servers
by derefr on Friday April 11, 2014 @06:34PM
(#7575996)
They wouldn't be doing it for the money. The EFF would be a good example of a firm that could take this practice up.
Re:How we got read access on Google’s production servers
by stingraycharles on Friday April 11, 2014 @11:13PM
(#7576832)
That's besides the point. It still costs money, and the company that's vulnerable is not the one paying it. A service like this would be time consuming (bogus reports, etc), and the EFF would still have to use money from donations to finance this.
The only thing I can think about is some security firm doing this, using the exposure as a marketing tool and establish them as an authority on the subject.
Maybe someone could set up a firm where individuals could hand them a vuln report, and then the firm would contact the vulnerable company on the individual's behalf. The firm would do the long, boring dance of "we suspect you're vulnerable to X, though we haven't tested it, but we'd like to do a free vulnerability test on you, so please sign this liability waiver", both protecting the individual from liability, and taking time the individual doesn't have. In return, if the company gives rewards, the firm could take a percentage.