Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 22 Jan 2018 19:42:23 -0800
From: Tristan Henning <>
Subject: Re: Re: How to deal with reporters who don't want
 their bugs fixed?

I don't know if you've all seen this, but, this is definitely how not to 
run a bug bounty.

And the /r/netsec discussion from reddit

A researcher found major infrastructure issues and after clarification 
of scope managed to compromise a very large part of DJI along with large 
amounts of PII. DJI sicked legal on him and he was forced to walk from a 
$30,000 bug bounty.

This document and story received a large amount of traction in the 
"hacking" community. How many bug hunters will be reporting issues to 
DJI in the future? My guess, not a lot...


On 1/22/2018 11:41 AM, Ian Zimmerman wrote:
> On 2018-01-22 17:20, Mikhail Utin wrote:
>>> Keeping it individual without public announced maximum embargo time
>>> would also help prevent folks from jumping to 0daying everything per
>>> default:)
>> However, to me it is pure "Security by Obscurity" in a bit different
>> wording. It never worked. Simply think that somebody else knows the
>> secret and with your help continues using that.
> I think you misunderstand the parent post.
> Nobody is proposing that the embargo period for any _particular_ issue
> be secret.  The proposal in the parent post was to not have a public
> general embargo policy for _all_ issues present & future.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.