Re: Bounty: Consultation on DRAFT Infrastructure and Services Vulnerability Disclosure Statement

[Rob Sayre <[e-mail]>]

Both (I donate the bounties).

I would suggest contracting it out to something like Hackerone for an
experiment, so the initial strain on the IETF is low.

thanks,
Rob


On Thu, Aug 6, 2020 at 12:28 PM Livingood, Jason <
[e-mail]> wrote:

> I have heard that some security researchers may not bother reporting
> absent a small bounty. So I would love to hear from any of you that may
> have direct experience either (1) being paid a bounty as a security
> researcher or (2) working at company that pays bounties (such as reacting
> to/validating those bugs).
>
>
>
> Thanks
>
> Jason
>
>
>
> *From: *ietf <[e-mail]> on behalf of Rob Sayre <
> [e-mail]>
> *Date: *Thursday, August 6, 2020 at 3:14 PM
> *To: *"Salz, Rich" <rsalz=[e-mail]>
> *Cc: *"[e-mail]" <[e-mail]>
> *Subject: *Re: Bounty: Consultation on DRAFT Infrastructure and Services
> Vulnerability Disclosure Statement
>
>
>
> On Thu, Aug 6, 2020 at 8:21 AM Salz, Rich <rsalz=
> [e-mail]> wrote:
>
>     >    * Whether or not this statement should be supplemented with a
> "bug bounty" program.
>
> In my experience (several years running openssl.org
> <https://urldefense.com/v3/__http:/openssl.org__;!!CQl3mcHX2A!QieyyWr7vAnR2jz6yx1D3fxr_mu4TMQOtrCTYOm7swW6-DqpFLzP5ztk1WNK4dInPmIXuesN$>),
> bug bounties for websites are not worthwhile.
>
>
>
> It really depends on how complicated the website is. Lots of web software
> companies have bounty programs: <https://hackerone.com/bug-bounty-programs
> <https://urldefense.com/v3/__https:/hackerone.com/bug-bounty-programs__;!!CQl3mcHX2A!QieyyWr7vAnR2jz6yx1D3fxr_mu4TMQOtrCTYOm7swW6-DqpFLzP5ztk1WNK4dInPjBP5Y6D$>
> >
>
>
>
> I think the IETF infrastructure might be able to use one. Trying it out
> seems like a reversible decision, too.
>
>
>
> thanks,
>
> Rob
>
>
>