46

Following on from a conversation with @shog9 on the DMZ, it was suggested to raise this here.

At the moment SE has a security contact page which details how to contact SE regarding security issues, but doesn't detail what actions are acceptable / unacceptable by a researcher when looking for potential security holes in SE sites.

Many companies, such as Facebook and Google have self-managed programmes and many others work via services like Bugcrowd or HackerOne.

The advantage of having a defined programme is that SE would likely get reports from security researchers who find possible security issues. Without a definition of what action is allowed / forbidden, many researchers won't risk probing a site for fear of legal issues.

Whilst this has been raised before on Meta.SE, I thought it was worth mentioning again as at the moment, the lack of defined guidance on acceptable actions likely means that SE is losing out valid contributions.

On the point of rewards that was raised on the previous question, most programmes have criteria for what is (not) considered a valid finding and these can be used to avoid "T-Shirt seekers".

If administrative overhead is considered an issue, using 3rd party services like Bugcrowd may help with that.

Improve this question
10
  • 3
    Related: meta.stackexchange.com/questions/232256 , meta.stackexchange.com/questions/276933 , meta.stackexchange.com/questions/276832 . Don't hold your breath.
    – Deer Hunter
    Commented Mar 31, 2016 at 20:48
  • 2
    Passing this around internally... Quick clarification: is your primary concern here defining the acceptable / unacceptable actions, or establishing a program for compensation?
    – Shog9 Mod
    Commented Apr 1, 2016 at 19:43
  • 6
    For me it's primarily that SE has a definition of acceptable/unacceptable things to do when bug hunting (so sites that are in/out of scope and activities that are in/out of scope), without that a lot of security professionals get nervy about testing stuff out, for fear of running afould of things. The facebook/google examples both have lists of what's in-scope in terms of sites and also activities, which gives people an idea of what they can do.
    – Rory McCune
    Commented Apr 1, 2016 at 20:15
  • 4
    I think the compensation bit is far less relevant, as many testers would do this for minimal reward, or even the pleasure of knowing they found something SE then fixed. But knowing what is allowed, what isn't, where the lines are, and how to communicate correctly are essential.
    – Rory Alsop
    Commented Apr 1, 2016 at 20:20
  • 2
    @Shog9, the compensation is probably really of no concern at this stage, as the Rorys have pointed out. If it get's to be of concern, a (already existent) wall of fame and some swag would be my suggestion for the start.
    – Tobi Nary
    Commented Apr 2, 2016 at 14:21
  • 2
    Has there been any update on this in either the 'yay' or the 'nay' direction?
    – WorseDoughnut
    Commented May 4, 2016 at 20:14
  • We need an update. Now. @Shog9
    – noɥʇʎԀʎzɐɹƆ
    Commented Aug 1, 2016 at 16:08
  • Ok, @uoɥʇʎPʎzɐɹC - updated.
    – Shog9 Mod
    Commented Aug 1, 2016 at 22:24
  • 1
    Re the compensation, its less about the reward, but more about the defined procedures to follow, and what to expect to happen. (though admittedly some would be in it for recognition, and some even for actual prizes.)
    – AviD
    Commented Aug 3, 2016 at 8:40
  • Shouldn't the status be changed to status-completed?
    – Mast
    Commented Jun 22, 2017 at 19:07

1 Answer 1

Reset to default
12

The dev team discussed this internally a while back. The general feeling is, we don't currently need a compensation program for this (and definitely don't need the additional overhead that one would create - you might be surprised at how long and how angrily some folks will argue for the value of their observation that modifying a page locally results in a page that is locally modified).

That said, we definitely appreciate it when folks who know what they're doing take the time to report problems. Beyond the basic guidelines for responsibly reporting these, I'd add only one:

  1. Don't abuse other users when testing. You can use your own account or create sockpuppet accounts, but do not test or demonstrate your theories on (or at the expense of) your unsuspecting peers.

Note that this necessarily discourages the finding or reporting of security vulnerabilities that involve going to another user's house with a wrench. I feel this is an acceptable tradeoff.

Improve this answer
12
  • the thing is - without one the exploit would be sold to a criminal organization
    – noɥʇʎԀʎzɐɹƆ
    Commented Aug 1, 2016 at 23:27
  • 1
    That's still a possibility with one in place. I don't know off-hand who'd pay for what here, but I'd suspect if you managed to get your hands on anything valuable it'd be worth a lot more than we'd be able to offer anyway. Bug bounties can trigger some rather perverse incentives.
    – Shog9 Mod
    Commented Aug 1, 2016 at 23:46
  • even a $5000 reward is enough. studies show people work hardest when they can give back and have a personal benefit.
    – noɥʇʎԀʎzɐɹƆ
    Commented Aug 1, 2016 at 23:51
  • even if you don't go illegal, you can post it on your blog (100% legal) in US and your site will still be ruined.
    – noɥʇʎԀʎzɐɹƆ
    Commented Aug 1, 2016 at 23:52
  • and why can't you reveal what the vulnerability was? (referring to the security contact page) GitHub describes theirs in immense technical detail, and so do many other sites
    – noɥʇʎԀʎzɐɹƆ
    Commented Aug 1, 2016 at 23:59
  • 2
    Every writeup takes someone with time to write it. If no one has time, nothing gets written. So guaranteeing a writeup is guaranteeing someone will take time. That doesn't necessarily make sense. Note that GitHub is a significantly larger organization.
    – Shog9 Mod
    Commented Aug 2, 2016 at 0:03
  • there are 8 vulnerabilities reported. a one paragraph writeup isn't too long, you guys write several paragraphs on meta every day
    – noɥʇʎԀʎzɐɹƆ
    Commented Aug 2, 2016 at 0:07
  • 2
    @Shog9 for me the important point is not compensation, it's having clear guidelines of what is / isn't acceptable in terms of sites that are in-scope, vulnerabilities that are / are not interesting and actions that are / are not acceptable. If you add some of that detail to your security page I think that would help (researchers may not look at this meta post for the bit about not abusing users...)
    – Rory McCune
    Commented Aug 2, 2016 at 8:30
  • Yeah, I'll toss it on the TODO list @Rory. FWIW, I spent a bit of time looking over some of the guidelines other organizations publish... Once you get past the pages of stuff on what they will / won't pay out for, the actual guidelines for testing mostly boil down to the same guideline I've written here: don't hurt other people.
    – Shog9 Mod
    Commented Aug 2, 2016 at 16:02
  • @Shog9 1. But you do have a site maintenance page and it explains technical details - and a lot of these white you can't do it for the bug bounty program. 2. A lot of the people who report to bug bounty programs work full-time finding security bugs. no money = no them
    – noɥʇʎԀʎzɐɹƆ
    Commented Aug 4, 2016 at 1:03
  • There's always more that could be done, @uoɥʇʎPʎzɐɹC, that would be really nice to have done. There are thousands and thousands of meta posts I'd like to see answered, hundreds of bugs I'd like to have fixed, dozens of features that'd be nice to have implemented. And there are never enough hours in the day nor dollars in the bank. You have to prioritize.
    – Shog9 Mod
    Commented Aug 4, 2016 at 1:45
  • 1
    @Shog9 and yesterday thousands of tech companies lost thousands of man-hours because SO was down for a minute yesterday
    – noɥʇʎԀʎzɐɹƆ
    Commented Aug 4, 2016 at 14:12

Not the answer you're looking for? Browse other questions tagged .