libber
Joined 18 years ago
Karma
48
Submissions
19
Member since
Aug 14
Application security engineer. Previously infosec consultant.
View on Hacker NewsRecent submissions
Comment · 9 years ago
Margaret-Ann Seger's post referenced in the article: https://www.facebook.com/margaretann.seger/posts/10214004058...
Comment · 10 years ago
A non-vulnerability like this is a good example of how easy it is to get press for $important_company + security.
Top of hackernews at the moment and fingers crossed there wont be a wave of articles about this in the coming days from tech press who don't fully understand the issue but know clicks when they see them.
Comment · 10 years ago
If there is someone to be upset with in this situation its accellion the vendor who backs files.fb.com.
Looking at how egregious their security mistakes are they dont appear to take security seriously.
This is the same company that (last I was down there) had a billboard on 101 that says "Secure".
Many echos of oracles "unbreakable" ad campaign while being an aggressively bad at security company
Comment · 10 years ago
(Wrote about this on reddit but I think it is pending approval, reposting here)
Hi - I work on the security team at Uber. I am this guy: techcrunch.com/2016/03/22/uber-launches-bug-bounty-program-that-pays-hackers-to-find-security-issues/
Yesterday we changed the language on our bug bounty page and I wanted to apologize for the confusion this caused. Since we launched our public bug bounty program on Tuesday, we have been reacting to the types of issues sent in and learning how to better define what we are looking for. This change was part of that, and not an effort to prevent anyone from earning bounties. The reason we clarified is so security researchers, whose time is valuable, wouldn't spend time on lower-risk issues like microsites that are unlikely to get a reward.
To Sean’s points about microsites, a microsite is usually a blog type site that rarely contains Uber user data and lives outside the Uber network. As such, even in cases where microsites are vulnerable, they pose a mild security risk to Uber which is why we clarified in our policy page to say that we do not reward them “except in extraordinary circumstances”. Sean also mentions that they are lower in severity: https://twitter.com/seanmeals/status/712975867236974592. Although the intent around microsites didn’t change, the language did. I apologize for this and we could have done better.
To the specific issue raised in your post, we have made it public: https://hackerone.com/reports/124975. As you mention, the payload does not fire so this is not a security concern.
A successful bug bounty rests on researchers trusting us to run it well, which we take very seriously. All the members of team running this program are part of the security community and many of us (mjb(1), jordan(2), rob(3)) actively submit to other bug bounty programs or perform security research as a hobby. We have awarded nearly a hundred issues via our pilot bug bounty program so far and we are excited to payout more in the future.
Our aim is to build a program by researchers, for researchers. I want to personally thank you for taking the time to submit your issue -- and any future issues. You can always see the scope and rules of our bug bounty program at https://hackerone.com/uber and you can feel free to mention my name in any reports to HackerOne to get my attention about an issue.
1. https://www.blackhat.com/us-15/briefings.html#bypass-surgery... 2. http://blog.saynotolinux.com/ 3.https://www.google.com/about/appsecurity/hall-of-fame/archiv...
Comment · 11 years ago
Maybe you know this, maybe you do not but these are all a nod to http://insecure.org/stf/smashstack.html which itself did not directly involve profit. It's a security thing.
Comment · 11 years ago
We sure do. Feel free to apply here at https://www.uber.com/jobs/28017 :)
Comment · 11 years ago
I found this interesting, feels like the most realistic account so far - http://pastebin.com/BjD84BQ3
I just feel bad for amazon people I meet, the 2 year cliff and high pressure oncall simply isn't a thing at the other tech companies. At least for me and ive worked at a few of them (plural of anicdote isn't data but still) Life seems strictly worse at amazon.
Comment · 14 years ago
Sounds like this may interest you - https://www.facebook.com/help/131112897028467/
Facebook wraps up every status update, picture, etc in a .zip file that you can download.
Comment · 14 years ago
Your declarative statements unencumbered by any research are fascinating.
What would be a better metric in your mind than MAU? Contrast facebooks MAU to google pluses "has a google account" metric.
The facebook prospectus also has daily active users of which at last count there were 483mil.
Comment · 14 years ago
One wrinkle - Doesn't this poll ignores anyone under 18? Facebook lets you sign up only once you have turned 13. Internet users between the ages of 13 to 18 are unaccounted for.
Comment · 15 years ago
Because google cannot make as much money off of an account named LispNerd3k vs your real name.
From an advertising pov G+ wants to have as much information about you as possible to best target ads. This is basically a good thing as you see more of what you want and they get more clickthrough and can sell ads for more. When you type something into google search, google can make an educated guess about who you are based on your query, geo information and past searches. A primary goal of G+ is to associate the G+ information you are voluntarily filling out (real name, address, hobbies, etc) with the rest of googles ad network making it leaps better.
That is why google thinks social networking is important, and why g+ doesn't need to "win" vs facebook for it to have a net positive effect on google. Even mild G+ adoption makes googles whole network of ads much more intelligent.
I am not a business strategy person but this explanation makes sense to me so take it as a guess/opinion.
Comment · 15 years ago
Facebook has 750 million users. [1]
Myspace has 63 million users, maybe less. [2]
I think userbase is a valid part of a social network argument. Or at least far from "patently flawed".
1. https://www.facebook.com/press/info.php?statistics 2. http://social-media-optimization.com/2011/03/myspace-loses-1...
Comment · 15 years ago
A compromised box someone proxies attacks from.
more mentions here: http://www.guardian.co.uk/technology/2011/jun/24/lulzsec-irc...
Comment · 15 years ago
Noble intentions but please don't do this in the future. Working in security (not at google) I promise we are trying to fix it as fast as possible already :)
You may also get cash+prizes if you submit as you did but don't release it publicly.
Comment · 15 years ago