Katie MoussourisOvjeren akaunt

You know who can’t afford to ban security researchers? Companies & govs who need to know about bugs researchers find, that’s who. Microsoft, which receives over 200,000 non-spam e-mail messages a year, made it a priority to improve relations with hackers. Bans make no sense. https://twitter.com/kenanistaken/status/1211751106189123590 …

Bans only make sense when the business model of the intermediary, a bug bounty platform, must use it to keep their own triage workforce costs down. Bans don’t help the customers of the bounty platform. It places the customer at risk of preventable 0 day drop by the researcher.

Even if no 0 day is dropped, the customer of bounty platforms now has to either manage the reports of the researcher outside the platform, or worse, never get more bugs from that finder again. So they will have outsourced a major piece of their security response only to weaken it

Bug bounty platforms were a great idea, but some got corrupted. To suit their own business model, triage is not done in the best interest of the customers or researchers. Both sides of this marketplace are being exploited in this model, but investors don’t care. We should care

Hackers have been complaining about these bad platform practices, but as non-employees, their individual stories of frustration like this are lost in the noise of medium posts. Only when customers of bug bounty platforms push back to demand better triage, no bans, will it improve