FRESH

Hacker News

Restructuring GitHub's bug bounty program

51 points by soheilpro

by wxw

1 subcomments

by dinkelberg

3 subcomments

So if the "wrong" person finds a critical vulnerability in GitHub, the payout is capped at $10,000. Might reduce the likelihood of it being submitted to the bug bounty program.

by everfrustrated

1 subcomments

Seems to me like the game theory here is un-credentialed reporters need to submit their reports through credentialed folks who will vet and take a cut on the way through.
Why take the lower offer by going directly.
That sounds like a win for everyone involved.

by saagarjha

1 subcomments

I wonder if this incentivizes people to form groups that self-vet for quality submissions to enhance their reputation.

by darkamaul

0 subcomment

I believe the changes here make a lot of sense because, most of the time, your best bugs are not your first ones
Anyone can point an LLM to a code base and ask to find a vulnerability - and the initial set of findings is going to be rather lame.
Encouraging researchers to stick to a target and to report 7 lows before getting in will probably make their contributions more valuable.

by Klaster_1

0 subcomment

by poly2it

0 subcomment

by Schnitz

0 subcomment

It is much harder to refute bullshit than to make up bullshit. As harsh or unfair as it might seem, this makes sense.

by sdevonoes

2 subcomments

by applfanboysbgon

0 subcomment

I mean, this is just a "fuck you", right? "Because there's a lot of LLM spam, we've decided that some researchers will get 1/4th as much pay for reporting the same bug as others, even if they didn't use LLMs". If anything this will have the opposite of the intended effect -- this strongly discourages humans who aren't part of the VIP program from reporting bugs they find to Github, so you'll probably see a higher ratio of LLM spam in the future. And don't be surprised if those bugs get sold elsewhere...

by nullsanity

0 subcomment

by fragmede

2 subcomments