Hacker News new | past | comments | ask | show | jobs | submit login

Are you basing this opinion on this one account? I would like to point out that Uber has a history of sleaze and would absolutely not use their behavior to judge any such programs. Are there other well described, similar instances of such poor behavior from legitimate companies?

It seems to me that most of the bigger corps offering bug bounties may be paying too little but at least they follow their own rules.




Khaos Tian published a writeup a few days ago about how he discovered a wide-open HomeKit vulnerability [0]. He reported it properly months prior, but Apple ignored his followups and was unresponsive. After this extended radio silence, Tian reached out to a media contact. Within hours of being contacted by the website, Apple finally pushed a hotfix for the vulnerability.

Apple subsequently denied Tian access to their bug bounty program because going to the press "voided the qualification for the invitation." [1]

[0]: https://medium.com/@khaost/your-home-was-not-so-secure-after...

[1]: https://twitter.com/KhaosT/status/943283519119179776


And this kids, is why blackhats are selling your vulns to other blackhats.


Clearly a problematic exchange, but, nowhere is it said that this is a bug bounty program interaction nor is it an account of Apple denying promised payment for such a program.

I'm certainly not justifying a poor communication and response to the report, but, it seems like a very different kind of problem, and not one reflective of the kind of corporate sleaze often seen from Uber.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: