mnutt has quit [Read error: Connection reset by peer]
mnutt has joined #sandstorm
<kentonv>
someone contacted me to report a "security vulnerability". The vulnerability is that we have a shell script on our server, and shell scripts do all sorts of dangerous stuff! The email says: "Step to reproduce: https://install.sandstorm.io/install.sh" and then contains a screenshot of a browser viewing that URL.
<kentonv>
why
<ocdtrekkie>
It's a Huntr thing innit?
<TimMc>
kentonv: We had someone gravely warn us of the presence of a robots.txt file on our site.
<TimMc>
Oh, by the way, that weird Cookie header thing? I think it's something in the Windows 10 network stack. :-)
<TimMc>
We observed it across a number of user agents and figured it had to be a proxy, but then someone noticed they were all Win 10. Maybe it's malware or AV screwing with stuff.
<TimMc>
The internet is full of wonders.
<kentonv>
oh yeah, shitty AV is totally plausible
<kentonv>
malware also plausible
<TimMc>
They can be... hard to tell apart sometimes.
<kentonv>
ocdtrekkie, no, I get these very-low-quality reports somewhat regularly, from people who are hoping we'll pay them a bug bounty even though we don't have any bug bounty program.
<kentonv>
I replied to the guy to tell him this is working as expected and he asked if he could get a bounty anyway for his efforts. -_-
<ocdtrekkie>
Like even if we didn't have to pay the bounty if we had one, I'd be personally annoyed if anyone got paid a bounty to complain we have an install script hosted on the website so people can use it.
<ocdtrekkie>
Just incentivized poor quality security work.
<kentonv>
yes, I certainly would never pay a bounty for this crap
<kentonv>
the most common report by far is missing DMARC records on sandstorm.io. People report this to me all the time and then ask for a bounty. I'm like "yeah I know, I don't really care enough to do anything about it"
<kentonv>
part of me thinks I should do it just so people stop reporting it and part of me worries that if I do then they'll claim I did it because they reported it and so they deserve a bounty even more
<kentonv>
hell I probably would have set up DMARC records by now if no one had reported it, I just don't want to now out of spite!
<ocdtrekkie>
My theory is that in most cases it's really important to have SPF and DKIM, and if those are working you are probably providing more than adequate information for mail servers to make good decisions.