Comment by Shank

4 months ago

In damage control mode, Zendesk can't pay a bounty out here? Come on. This is amateur hour. The reputational damage that comes from "the company that goes on the offensive and doesn't pay out legitimate bounties" impacts the overall results you get from a bug bounty program. "Pissing off the hackers" is not a way to keep people reporting credible bugs to your service.

I don't understand what this tries to accomplish. The problem is bad, botching the triage is bad, and the bounty is relatively cheap. I understand that this feels bad from an egg-on-face perspective, but I would much rather be told by a penetration tester about a bug in a third-party service provider than not be told at all just to respect a program's bug bounty policy.

4 comments

Shank

Reply
teddyh  4 months ago

> "Pissing off the hackers" is not a way to keep people reporting credible bugs to your service.

That doesn’t matter if your goal with a bug bounty program is not to have people reporting bugs, but instead to have the company appear to care about security. If your only aim is to appear serious about security, it doesn’t matter what you actually do with any bug reports. Until the bugs are made public, of course, which is why companies so often try to stop this by any means.

  • johnnyanmac  4 months ago

    sounds like a great way to get a bunch of black hats to target you after pissing off the white hats. Playing nice with people this smart should be precisely to prevent this kind of damage to a company that results in losing clients.

    But I geuss corporations ignoring security for more immediately profitable ventures on the quarterly report is a tale as old as software.

Ylpertnodi  4 months ago

>In damage control mode, Zendesk can't pay a bounty out here?

Reading all the many comments, it would appear the damage has been done. Good. But very unnecessary on zd's part.

bigiain  4 months ago

"Hi, we are ZenDesk, a support ticket SaaS with a bug bounty program that we outsource to our effected customers, who pay out an order of magnitude more than our puny fake HackerOne program. Call now, to be ridiculously upsold on our Enterprise package!"