On one hand, this is valid. On the other hand, security researchers can be some uber-paranoid weirdos who prefer to be entirely anonymous, and this could have a chilling effect.

Net net it’s probably positive it’s just too easy to spam these otherwise.

▲

lrvick 2 days ago | parent | next [-]

In all past bug bounty programs I started I made it clear we would only prioritize findings as serious if PGP encrypted to the security team PGP key to review offline.

The serious researchers all knew how to do this and complied and usually got paid, and the unencrypted stuff was basically always noise we never paid out on.

Probably not as much of a filter now that AI is in play though.

▲

nullc 2 days ago | parent [-]

That kind of stuff won't work anywhere near as well as a bullshit filter anymore: Most of the bullshit is AI generated and AI has no problem following rules like that-- even better than humans.

Instead, you'll need something like "you must enroll your pgp fingerprint in our system by sending a handwritten postcard featuring a tourist attraction in your region".

	▲	lrvick 2 days ago \| parent [-]
		> Instead, you'll need something like "you must enroll your pgp fingerprint in our system by sending a handwritten postcard featuring a tourist attraction in your region". I might steal some variation of this!

▲

lazide 2 days ago | parent | prev | next [-]

When you see how shitty many companies are in going after legitimate folks reporting real security vulnerabilities. it frankly shocks me that anyone would ever use their real name.

▲

kccqzy 2 days ago | parent | prev | next [-]

The kind of security researchers who prefer to be entirely anonymous are not seeking monetary rewards from bug bounties. No company would pay such researchers anonymously (like using Monero). If they accept bitcoin well they aren’t really that into being anonymous.

▲

lrvick 2 days ago | parent | next [-]

I have paid anonymous security researchers in past bug bounty programs, and would do it again. Way better than paying anonymous ransoms later.

▲

dgellow 2 days ago | parent [-]

I’ve done the same, but they eventually need to provide a bank account, which generally is at their name

	▲	lrvick 2 days ago \| parent [-]
		Cryptocurrency is generally preferred by anons in my experience.

▲

esseph 2 days ago | parent | prev [-]

[flagged]

▲

edot 2 days ago | parent | prev [-]

They use Persona, which is heavily invested-in by Peter Thiel's Founder's Fund. Peter Thiel, of Palantir (funded initially by In-Q-Tel, the CIA's VC arm). No shit security researchers don't want to give ID scans and biometric data to them.