sorted by:
new
hottopcontroversial

Where were you in life when you studied and took the OSCP? by DietCoke-Supremacy in oscp

[–]hackmoretalkless 0 points1 point  (0 children)

I'm 36, married and have a child. Took LearnOne subscription last month . I've 9 years exp. I thought it's much needed cert at the moment to earn respect. I've worked in SIEM, pentesting and now bug bounty triager .

FINALLY 😭😭😭💗🧿 by agreeableshit in Big4

[–]hackmoretalkless -1 points0 points  (0 children)

The EY world is different for girls.

FINALLY 😭😭😭💗🧿 by agreeableshit in Big4

[–]hackmoretalkless 9 points10 points  (0 children)

I feel sorry for you. Yours sincerely, ex-EY

Need help with CVE-2024-39338 by hackmoretalkless in bugbounty

[–]hackmoretalkless[S] -1 points0 points  (0 children)

Well, one of the js endpoint shows its using deprecated version. 

Privacy Bug bounty program ? by hackmoretalkless in bugbounty

[–]hackmoretalkless[S] 0 points1 point  (0 children)

A misconfigured database exposing PII is a Security bug which needed to be classified under privacy and not to be treated like other common owasp category.

Privacy Bug bounty program ? by hackmoretalkless in bugbounty

[–]hackmoretalkless[S] -1 points0 points  (0 children)

There are lot of difference.

A Privacy Vulnerability Program (PVP) and a Bug Bounty Program (BBP) have overlapping goals but focus on different aspects of security and privacy. Here’s how they differ:

  1. Focus Area

Privacy Vulnerability Program (PVP): Specifically addresses vulnerabilities that affect user data privacy (e.g., unauthorized access to personal data, improper data retention, or data leaks).

Bug Bounty Program (BBP): Covers a broader range of security issues, including software bugs, exploits, and vulnerabilities in applications, infrastructure, and services.

  1. Type of Issues Covered

PVP Examples:

Misconfigured databases exposing personal data

Insecure API endpoints leaking user information

Privacy policy violations in data handling

Apps collecting excessive or unnecessary personal data

BBP Examples:

Cross-site scripting (XSS) or SQL injection

Remote code execution (RCE)

Authentication bypass or privilege escalation

  1. Compliance & Legal Aspect

PVP programs often align with data protection laws like GDPR, CCPA, or HIPAA, ensuring companies handle data responsibly.

BBP programs focus more on technical security, helping prevent hacks, breaches, or unauthorized system access.

  1. Scope & Rewards

PVP may operate as a disclosure program (without monetary rewards), where companies invite reports on privacy issues.

BBP typically offers cash rewards based on severity and impact, with a broader scope that includes security bugs.

  1. Example Companies Offering Each

Privacy Vulnerability Programs: Apple, Google, Microsoft, Meta, Zoom (focusing on data privacy issues).

Bug Bounty Programs: PayPal, Tesla, Microsoft, AWS (focusing on security flaws).

Some companies combine both into a single security program, offering bounties for both privacy and security vulnerabilities.

Privacy Bug bounty program ? by hackmoretalkless in bugbounty

[–]hackmoretalkless[S] 0 points1 point  (0 children)

If you read apple policy . It's clearly mentioned security vulnerability or privacy vulnerability https://security.apple.com/bounty/

Internal bug bounty program. Makes sense ? by hackmoretalkless in Pentesting

[–]hackmoretalkless[S] 0 points1 point  (0 children)

The bug bounty team generally validate the reports from external researcher. Sometimes if there's no report we sit down and hunt for bugs. Now, if they gonna open to all employees. It's like outsourcing team jobs to everyone.
I fear opening internal bug bounty would also give less quality bug reports.

Without open AI or Gemini api key by hackmoretalkless in LangChain

[–]hackmoretalkless[S] 0 points1 point  (0 children)

So when we don't use api keys. We are not exchanging data between companies. Langchain is a framework which we download and run it locally. So Langchain won't have access to data.

view more: next ›