4chan announces vulnerability disclosure program

http://blog.4chan.org/post/84931784192/announcing-4chans-vulnerability-disclosure-program

by forlorn • 12 years ago

66 52 12 years ago

blog.4chan.org

eggbrain2• 12 years ago

Key terms:

For each eligible vulnerability report, the reporter will receive:

* Recognition in our Hall of Fame.

* Either $20 in self-serve advertising credit valid for one year, or a 4chan Pass valid for one year ($20 value, subject to Terms of Use).

Sir_Cmpwn4• 12 years ago

So a gold star and a kiss on the cheek, basically.

k__• 12 years ago

Moot is a poor lad.

aroch• 12 years ago

You could probably convince /g/ to send them the appropriate X-rated images too

JonnieCache2• 12 years ago

A 0day pat on the head from 4chan is pretty solid nerd cred for the CV.

Maybe he's so worried about the rest of the code that he thinks a $10k bounty could quickly ruin him :)

moot4• 12 years ago

The goal was to create a framework through which people could safely test and report exploits. In addition, 4chan isn't in a financial position to dole out large bounties.

robobro4• 12 years ago

Why don't you open source your moderation panel, or at least release screenshots of it? 4chan has had a lot of beautiful code submitted by volunteers every year. It's a shame to keep it all locked up.

eggbrain2• 12 years ago

Sorry, I hope I didn't come across as being attackative. It just took a little digging for me to find the terms.

I totally understand that you can't offer a $1,000 bounty, you aren't Google or Facebook.

Would it be possible, however, to take donations (cryptocurrencies?) that can be used specifically for the bounties? I'd put in 50k DOGE towards that, and I'm sure others would too.

Sir_Cmpwn4• 12 years ago

You could send a T-Shirt or a candlelit dinner or something. The current bounty just seems insincere.

rdl• 12 years ago

I think the Hall of Fame is worth more than the $20.

This is one of those cases where the $20 is probably worse than $0, though (even though it's non-cash). It's like "hey, friend, will you (help me move|have sex with me|etc)"; more likely to do it as a favor than when $20 is offered. Probably even more likely to do it for $1k than as a favor. $1000>0>$20.

ginko• 12 years ago

I think the Hall of Fame recognition would be a bigger honor if it were hosted on 4chan.com.

A one year 4chan pass is pretty neat, though.

bvttf• 12 years ago

Sad this isn't an announcement of a new /0day board that serves as a pastebin alternative.

eyeareque• 12 years ago

This is great. Before long it will be more rare for a site/company to not have a bounty program vs. having one.

ctb_mg3• 12 years ago

I think it would be a very good idea for moot to bite the bullet and pay for a moderately thorough security audit of 4chan's code.

This one-time investment would hopefully resolve most of the major/obvious security issues. Then the code could be open-sourced with moderate confidence that a million 0days would not be exploited instantly -- and the community can catch the obscure holes.

moot4• 12 years ago

I think it would be a very good idea for moot to bite the bullet and pay for a moderately thorough security audit of 4chan's code.

Where/who would you suggest? I'm certainly open to the idea.

ctb_mg3• 12 years ago

I don't know myself. Perhaps others can speak of reputable resources?

TallGuyShort• 12 years ago

I have a feeling you could post the code on /b/ and find out about some vulnerabilities very quickly.

edit: On a more serious note, I've done some work with Palamida and been quite impressed. They can be pricey though. I know you're not keen to accept monetary donations, but I wonder if getting a reputable company to do it for free would work. I'm sure there's plenty of goodwill toward you in the technical community.

sillysaurus33• 12 years ago

Matasano: http://www.matasano.com/

It's a well-respected security firm that's been around for a long time.

heinrich59913• 12 years ago

Is the host down?

Sir_Cmpwn4• 12 years ago

Do you have HTTPS Everywhere installed?

heinrich59913• 12 years ago

Yes.

4chan announces vulnerability disclosure program

Related Stories