Hacker News
points by appplication 1 day ago | 0 comments
On one hand, this is valid. On the other hand, security researchers can be some uber-paranoid weirdos who prefer to be entirely anonymous, and this could have a chilling effect.

Net net it’s probably positive it’s just too easy to spam these otherwise.

[–] lrvick 1 day ago
In all past bug bounty programs I started I made it clear we would only prioritize findings as serious if PGP encrypted to the security team PGP key to review offline.

The serious researchers all knew how to do this and complied and usually got paid, and the unencrypted stuff was basically always noise we never paid out on.

Probably not as much of a filter now that AI is in play though.

[–] nullc 1 day ago
That kind of stuff won't work anywhere near as well as a bullshit filter anymore: Most of the bullshit is AI generated and AI has no problem following rules like that-- even better than humans.

Instead, you'll need something like "you must enroll your pgp fingerprint in our system by sending a handwritten postcard featuring a tourist attraction in your region".

:P

[–] lrvick 1 day ago
> Instead, you'll need something like "you must enroll your pgp fingerprint in our system by sending a handwritten postcard featuring a tourist attraction in your region".

I might steal some variation of this!

[–] lazide 1 day ago
When you see how shitty many companies are in going after legitimate folks reporting real security vulnerabilities. it frankly shocks me that anyone would ever use their real name.
[–] kccqzy 1 day ago
The kind of security researchers who prefer to be entirely anonymous are not seeking monetary rewards from bug bounties. No company would pay such researchers anonymously (like using Monero). If they accept bitcoin well they aren’t really that into being anonymous.
[–] lrvick 1 day ago
I have paid anonymous security researchers in past bug bounty programs, and would do it again. Way better than paying anonymous ransoms later.
[–] dgellow 1 day ago
I’ve done the same, but they eventually need to provide a bank account, which generally is at their name
[–] lrvick 1 day ago
Cryptocurrency is generally preferred by anons in my experience.
[–] edot 1 day ago
They use Persona, which is heavily invested-in by Peter Thiel's Founder's Fund. Peter Thiel, of Palantir (funded initially by In-Q-Tel, the CIA's VC arm). No shit security researchers don't want to give ID scans and biometric data to them.