Comment by malfist

2 years ago

It's a bug bounty, not a "only if we have time to fix it" bounty.

He found a security problem, they decided not to act on it, but it was still an acknowledged security problem

24 comments

malfist

Reply
coldtea  2 years ago

>It's a bug bounty, not a "only if we have time to fix it" bounty

It's only a bug if it's not intended

  • bmitc  2 years ago

    I think a lot of developers and companies interpret "that's the way the code or process works" as intentional behavior, which is not always the case.

madeofpalk  2 years ago

The point of a bug bounty is for companies to find new security problems.

If the (class of) problem is already known, it’s not worth rewarding.

  • berdario  2 years ago

    I can see this argument making a bit of sense, but if they documented this 3 years after the issue was reported, they don't have a way to demonstrate that they truly already knew.

    At the end it boils down to: is Github being honest and fair in answering the bug bounty reports?

    If you think it is, cool.

    If you don't, maybe it's not worth playing ball with Github's bug bounty process

    • tptacek  2 years ago

      It doesn't matter if they knew. If they don't deem it a security vulnerability --- and they have put their money where their mouth is, by documenting it as part of the platform behavior --- it's not eligible for a payout. It can be a bug, but if it's not the kind of bug the bounty program is designed to address, it's not getting paid out. The incentives you create by paying for every random non-vulnerability are really bad.

      The subtext of this thread is that companies should reward any research that turns up surprising or user-hostile behavior in products. It's good to want things. But that is not the point of a security bug bounty.

      5 replies →

  • andrewinardeer  2 years ago

    If a renown company won't pay a bug bounty, a foreign government often will.

    • prepend  2 years ago

      Good luck selling this to a foreign (or domestic) government. It doesn’t seem valuable to me, but who knows, maybe someone finds it worth payout.

K0balt  2 years ago

The property (“bug”) in question is an inherent and intentional property of meekly-tree type storage systems such as git.

Calling this a bug is like reporting that telnet sends information unencrypted.

The actual bug is in the way that their UX paradigm sets user expectations.

  • yencabulator  2 years ago

    Don't blame Git for Github decisions.

    Github chooses to store all "Github forks" in the same repository, and allow accessing things in that repository even when they are not reachable by the refs in the namespace of one "fork". That is purely a Github decision.

    • K0balt  2 years ago

      They could have split forks off into new repos, but then they wouldn’t be forks, in the repository sense. It was never hard to just copy a repo instead of forking it. The UX just leads people into holding it wrong.