From ‘Hackers Are Criminals’ to Industry Leaders — What Changed?

Welcome back to the ThreatCon One podcast. I'm here today, Patrick Garrity, security researcher, with Kimber Duke, director of product at VulnCheck.

Nailed it.

I got it that time. Good job. And we have a guest, Casey John Ellis, founder of Bugcrowd. So it's great to have you on and get to talk to you about security stuff.

It's cool to come on and jam.

Yeah. Yeah. So much has changed in the security industry. Yeah. I'm curious to hear your perspective on like current state and maybe we can dive into some things on vulnerability disclosure and bug bounties and all that fun stuff.

Sure. Well, current state is like we're doing everything faster and you know, with more energy, um, probably the good, bad, and the ugly. So like walking around RSA and BSides, it's just chaos.

It's always chaos.

We've got all these vendors and like we've got all these solutions, but like we're still dealing with the same problems fundamentally. We're just doing them like louder and faster.

Something about this year feels especially frenetic. Like there's a buzz that's very fast.

Yeah.

And in the meantime, you know, you've got, um, You've got like a geopolitical environment that's getting spicier and spicier. You've got AI that's put capability in the hands of a broader variety of people. Yep. We're kind of realizing that we were way more vulnerable than we thought in terms of people outside of security research. Like we've kind of known that, but now it's becoming pretty obvious. Yeah. Right. So there's a lot of like, there's a lot of things in the pot at the moment. And like for me, that's kind of exciting. Like that's where the, you know, the founder kind of entrepreneur spidey senses kick off and it's like, what can we do about all of this? But it's like, I sense a lot of problems to solve. Yeah, there's a lot of problems out there to solve, but I think a lot of things are boiling up at the same time. Upside is there's some really good conversations being had, but we gotta start doing a couple of things differently, I think. Yeah.

Well, to set the stage for all of that, do you wanna give us a rundown of how did you get to founding Bugcrowd? What was the journey there?

Yeah, okay. So I'm a child of the early '80s, so like Oregon Shell generation at that era. Grew up hacking stuff. Basically at the end of high school, almost tripped over into a network engineering apprenticeship and started hacking things in that context, which is when I realized that like, oh, you can actually do offensive security work and people can get value from it. This is like 2001. So the security industry didn't really exist yet. But being able to talk to people about like, hey, this is risky, you should fix it. Let me demonstrate it to you. That's sort of how I got my start in security as a career. You know, one thing led to another. I did tech for about 6 years, moved over to solutions architecture and sales for about 3 years, and then realized if I'm doing both, I should probably be an entrepreneur of some sort. So, you know, broke bad and did a couple of things. Yeah, really Bugcrowd came about like having grown up in the hacker community, like there was really 2 things I wanted to solve. One was the fact that like hackers, historically, um, people just assumed we were doing bad things, right? Right. This idea that like there is such a thing as like a locksmith, not a burglar, or, you know, like I describe myself as someone who likes thinking like a criminal but doesn't want to be one, right? Like that persona didn't— wasn't understood at all when we started. And you know, that meant that that entire community wasn't really able to do what it does to make the internet safer freely. So I wanted to do something about that. And then the other thing was just, you know, this idea that, like, at the time I was running a pen test company, and it's like, okay, if our job is to outsmart this crowd of adversaries that have got, like, all sorts of different skills, motivations, and kind of an incentive to win, and we're trying to beat that with one person being paid by the hour— yeah, like, they can be the smartest person on the planet, they're going to fail because the math is wrong. So it was those two things together. It was kind of a light bulb moment that I had at one point just after Google, um, started talking about their bounty program. Um, and yeah, one thing led to another and now we're here.

What year did you found the company?

Uh, started working on it in 2011, like launched the first program in 2012.

Yeah, that's early.

Yeah, pretty early.

I, I didn't, I was, I was adjacent to security. I was more on the network engineering side.

Yeah.

And computer repair early on, like home, small business.

Yeah. So we're probably similar vintage on that side. Yeah.

But 2012, there was 400 cybersecurity companies. Really? Like, it was very small. There's, I think, somewhere around 4,000 today. Yeah. And so just growing up, seeing that blow up over the last decade plus has been pretty wild.

Yeah. I mean, I think the industry, you know, I love security. Yeah, with the capitalist entrepreneur hat on, I love it because there's so many things to solve and there's opportunities to grow and do all of that. But like, take that off, put the hacker hat on, like I just love solving problems right out on the edge of what's known.

It's funny, I'm going to like capitalize on that a little bit because one of the main things that I'm focused on this year, just like personally, is bringing the creativity back from the hacker side.

Oh yeah.

And I just, I feel like we've lost that so hard. And I think maybe like some of the business, businessification of the hacker has really taken a toll on a lot of us. So for me personally, I'm like, what can I do to be creative in this environment and bring some of that hacker energy back to myself?

I love that. I love that. And I fully agree with that. Like the advantage, you know, when, when we first came out, so I'm from Sydney, Australia for the, for the listeners, you guys know that, but just in case you're wondering where the funny accent comes from, right? I've been out here in the US since 2013. But when we first came out, um, you know, it was actually— we landed the same month that Snowden, uh, all that stuff dropped, right? And the thing that was interesting about that is I don't think prior to that there was a single global event. Yeah, they got everyone thinking about computer security and hacking as a thing that potentially affects them. I don't think there was anything that happened before that, and then that dropped, and all of a sudden it's like, shit, maybe this is relevant. Yeah. And it kind of went from there because I feel like prior to that, it was zealots and evangelists on the street corner trying to get people to care. Like the idea of hackers having a seat at the table to have conversations about this stuff, the fact that security is even a topic of conversation was absurd back then.

When I was on the more of the systems network side and I was a sales engineer, the only time you would sell security solutions was predominantly compliance driven. So like the reason why you would deploy RSA SecureID was because PCI required you to deploy two-factor authentication.

Yeah, PCI, PCI DSS.

And I experienced a similar wave at that time. That's when credential compromise. And I ran into Doug Song at Duo at like a meet and greet lunch tech event. I didn't even know who Doug was. No idea who Doug was. But, but yeah, I was like, oh, you've made this so much easier. And everyone made fun of me for joining a security company. They're like, dude, security, no one cares about security. It's a worthless thing to go spend your time on. And, uh, yeah.

And staying ahead of the pot.

Yeah. The, the timing of, of the wave of credential compromise and the, like the, the Target breach was probably the biggest.

Oh, I think Target was like where the consumers realized like, oh no.

So I actually do, I do a narrative arc on this. I was like, okay, 2013, Snowden, hacking happens. 2014 was Target, Home Depot. Um, it was like 60% of the US population had its credit card popped that year.

Yeah.

So hacking happens to me.

Yeah.

The following year, Ashley Madison.

Yeah.

Yahoo.

Like, uninsurable stuff. Like, hacking happens to me and it hurts.

Yeah.

And like, there's this kind of escalating story in the zeitgeist that kind of coincided with that whole period.

And now it's every day.

And now it's like hacking just like my lobster is hacking my other person's, like whatever they have.

Assume your identity is breached at all times is like some of the new guidance that's given. And it's just like, oh, well, those were wild times.

Like several of those things. I was running sales engineering at Duo. So iSight Partners would call Duo on and I didn't know what, I didn't even know what incident response was. I was just called in on a Saturday and a Sunday to deploy two-factor. Yeah. And it's like, cool, let's go. And had no idea the, aspect of like how impactful. Yeah, it was funny. My wife's like, why are you watching the Ashley Madison Netflix special?

And I was like, there's reasons.

Well, like, trust me, honey, I'm not in the movie, but like, yeah, you know, some stuff that went on in the background.

I think it's, I mean, like back to what you said, Kimber, about bringing the creativity and some of the scrappiness back into hacking. Like I do think like it's fun to talk about these stories and all that kind of thing, but I do think it's useful for people that are coming in kind of new to realize that like, this is pretty recent.

Yeah, we have a whole new generation who's coming into this. And I think they're— we— this has been a recurring theme of our conversations of like, how are we, how are we tackling this? Like in this new environment? And it's like, it's not just the new generation who has to think about these things. It's the current generation because we've been solving problems the same way for a very long time. So, yeah. Bring your creativity back and see what you can do.

Yeah, exactly.

So the topic I'm interested in talking some bit about, vulnerability disclosure practices. You have extensive experience in that area in bug bounty.

A little bit, yeah.

Yeah, and so curious, like, what do you see changing? what's changed over time?

Yeah, there's so many things. I mean, like, partly what we just talked about, this idea that, like, the hacker, I think, in general is seen as potentially good now, not like always good or always bad, but it used to be always bad. Now it's potentially good, which is great. That gives us, you know, a seat at the table from like a policy and even like, I love hacker, hacker turns CISOs. Because they actually get, you know what I mean, like a different breed, right? Um, that's becoming more common. So we've got like, we're in leadership now, um, you know, we're able to impact policy, which is something that I've done like a lot of work on, you know.

That's really important.

Post the initial growth of Bugcrowd, it's like, all right, how do we start to lock this in at the system level? And that's, that becomes a policy issue. And we can kind of do that now, which is like wild. I think that's a big shift. Um, But yeah, in terms of vulnerability disclosure itself, it's interesting because like we're still at this point where, you know, the fundamental conversation is you kind of walking through the front door and calling someone's baby ugly.

Yeah.

Right.

Yeah.

Or saying you did it wrong.

Yeah.

Or whatever variation of that it is. Right. So like if the receiving side is not prepared for that, then it's an inherently adversarial conversation to have. Right. Yeah, to me, like, the two ends of that, like, one is improving preparedness on the receiving side, because ultimately, like, we, you know, every organization screws up. Yeah, that's just because humans work there, right? Like, we're awesome, um, you know, computers magnify our mistakes, and that's just QED. It's not even necessarily a bad thing, it's just how it works. On the researcher side, actually having empathy for that.

Yeah.

And trying to work out how to, you know, communicate more effectively and actually make what we're doing more, more useful for the sake of like public safety. You know what I mean? Yeah. And like, yeah, get your CVE, get your bug bounty, get your like personal brand bits and whatever else it is that you're trying to get out of it yourself. But at the system level, like this conversation, I feel like we made a ton of progress and then it kind of got a little bit wrapped around the axle over the past few years.

Yeah.

I agree with you. Um, I think a reality is software is not built Most software is built to solve a problem that's not related to security. And I think we're seeing this even now with the acceleration of software. It's there to solve a problem and it can solve a problem amazingly. But a lot of times security is not even a consideration in that software being built.

And oftentimes it's hard enough just to make the damn thing work, let alone like not do all the things it's not meant to do, which is where security is.

More time is spent on reliability of service or function accomplishing new feature sets.

Yeah.

And I think there's an aspect of, you don't want to slow that down. But at the same time, like you have to take into consideration the security side. So yeah, it is interesting. Like I think on the newer open source projects, like some people are incredibly resistant. Like don't call my baby ugly. And other people are like, thank you so much. Well, we fixed it. Yeah.

Yeah. And it's an interesting one because to me, like, a vulnerability is like a fact in and of itself. So it's like, cool, you know, organizations that go out there and say don't submit fault reports. It's kind of like walking outside when there's a storm approaching your house and saying, don't hit me with lightning. Yeah. Like, that's not how any of this works, right? It's not listening. If it could hear you, it wouldn't care because it's got lightning on its side. So like, what do you do instead? You put up a lightning rod. Anticipating that so that you can like get the information to the right place, channel it around where it's going to cause damage, deal with it safely. Like that to me is a fun metaphor for vulnerability.

I love it.

Vulnerability programs, right? That's like— White Bunny's like shooting rockets up into there and not everyone should necessarily do that either.

But yeah, it's a whole other pattern.

It's a whole other thing. Yeah.

So there's this concept or term that vendors often use, responsible disclosure.

Yeah.

What are your thoughts on that framing?

Yeah, so it's a really interesting one because like the idea of responsibility was like actively weaponized against researchers in like the '90s and through the 2000s. I feel like that's kind of less true today, but there's still a hangover from that. So you'll get some really strong reactions if you use that term from people that have been around for a while. I prefer to talk about it as vulnerability disclosure and just take all of the moral loading out of the—

Keep it as factual as possible.

Like, what are we actually doing here? Let's not talk about why or who or any of that other stuff because it's complicated enough as it is without adding that stuff to it, right? But in terms of like, advocating for the term, two things. One is that it is a term of art that makes folks on the receiving side more comfortable with the conversation to begin with. If they haven't started, that's actually pretty important, right? And the other is that responsibility literally means the ability to respond. Like, that's a bilateral thing. That's not just one-sided, right? So, Yeah, that's not how it's used and it's kind of a little bit academic, but, um, you know, when like Bugcrowd used that term really early on, I remember getting like crash tackled by Steve Christie-Coley at a DEF CON. You can't say that. I'm like, okay, hang on. Let's have a conversation about this and kind of presented that to him. And he got it. It's like, yeah, there's all of these moral kind of historical pieces of baggage associated with it, but I understand what you're trying to do here because you're actually trying to market. Get this concept out to get it adopted. And like, words mean things and they matter and how people feel about stuff kind of matters as well.

Yeah.

There's no shortage of hackers that want to do this stuff. It's like the limiting function has always been the number of companies that are ready for it and being proactive about it. So like making them comfortable in that process kind of counts.

Not just from like a funding point of view, but like from a process-oriented point of view.

Just pure adoption. Like, I mean, like this is one of the reasons, you know, I started Disclose.io. Kind of separate to Bugcrowd because Bugcrowd's crowdsourcing. It's, you know, it's a for-profit. It's doing triage. It's doing AI stuff now, all those different things. In the meantime, like, VDP is just a part of how the internet works and everyone needs to understand that.

Yeah.

Period. Like, that's not a— to me, that's not even a commercial thing. It's like an issue of physics.

Yeah. Um, on that note, so disclose.io, super cool project. Um, uh, Everyone should check it out. How should, like, you have the two different dynamics of a software supplier vendor.

Yeah.

Not every, you know, open source projects aren't necessarily vendors. And then you have a researcher. What is your advice for each of them on how these things should work?

Yeah. How it should work. How it should work is we all just like tiptoe through the tulips and it's a, you know, it's an error is human. I'm completely cool with you calling that out.

And on the research side, it's like, it's fixed in an hour.

The researcher side is like, I'm totally empathic towards your, like, your business considerations. That's never how any of that works. So I think on the receiving side, like, the reason, for starters, the reason we started Disclose.io was to actually try to put pressure on the DOJ to reform the Computer Fraud and Abuse Act. So like the default, you know, felony charges around hacking in the US basically assume that you're criminal, you have to prove that you're not. Um, so if you exceed authorized access, That's automatically a crime and it's like old, it needs to get fixed. So the idea with Disclose.io was to build safe harbor provisions into volume disclosure policies and get enough people to adopt that to actually create precedent that we could use to lever up into DC, which worked. We got that done in 2022 after 6, 7 years of working out. It takes time, right?

Like Paul says, educating everyone.

Yeah. And it's, It's got to be consistent as well. And I think the more you can build out precedent to try to create a change, like the easier that change is going to be.

Thanks for being that person.

Cause, uh, yeah, it took a village as well. That wasn't just me, but like, that's a big part of what the, the, the project was designed to do originally. Um, kind of what it's turned into since is like this series of different things that are like there to help make vulnerability disclosure and that conversation. That you just mentioned, like easier, like how do we just make it suck less? Um, so, you know, I think for, for companies receiving reports, like putting a policy out, like having people, you know, being able to drive people to the right place to actually send you that report, because in the absence of that, they're going to post on Twitter or, you know, ping you, see you on LinkedIn or whatever. It's not because they're jerks, it's because they're trying to tell you something and they don't know how.

So many, so many researchers I've engaged with, it's interesting, they're like, I just drop ode all the time because I won't pay attention because like I, I reach, I, I try and go through all these avenues and they never respond, or like, and it's a waste of my time.

So the Optus, the Optus breach in Australia, um, a couple years back, I forget exactly when it was, but it was like literally like 60-odd percent of the population of the country got hosed. Um, and you know, the, the researchers did that. It was like an exposed API endpoint and they just snaffed it. Um, but then they decided let's try to extort and whatever else on the back end, and that didn't go well for them. But yeah, as they were kind of backing away from it all, they're like, had we, you know, had there been a vulnerability intake point that we could have sent this to, we just would have done that. Yeah, like we just didn't know what to do. And at some point along the way, they realized what they were sitting on was potentially useful for extortion. So they tried that on.

That's one of the big things that's come up in my conversations with researchers, hackers, you know, from, from my life is just, I don't know the process for this. And can you help me walk through the process of this? And like, truly, how long am I supposed to wait after contacting a company, you know, security@company.com? And like, what is, what is responsible for me to do? Because like, ultimately, I want to do the right thing. And nobody like I don't think any of the companies realize, like, when you sign up to be a hacker, you're going to poke around at things and nobody tells you what the right thing to do is.

Correct. Yeah.

And it's all very, like, morally gray.

Yeah. And ambiguous and kind of scary. I mean, we've seen this all the time, like, kids jumping into vuln research and just dropping things on Twitter because they read a blog post that Tavis Ormandy wrote in 2012 and they just think that's how it works.

Yeah.

Like, they haven't thought through the equities because they don't know to do that. They just— like monkey see monkey do. So, um, yeah, again, on like the control point for that is the vendor.

Yeah.

So it's like, okay, we're going to need 90 days. Or like if you're, you know, a medical device manufacturer or you've got satellites or you've got something that takes a long time to regress and you can test and fix. Okay. We're going to need maybe a year.

Yeah.

Um, if we fix it sooner than that, then you'll be able to publish it sooner. But for the sake of the safety of the user. Of this product. Like, if you set that expectation proactively, then at least you've got a baseline and you're making it easier, right?

Yeah. I used to, I used to give the career advice for people I mentored to be like, get a CVE. Yeah. I think that's kind of changed now. I would say that's a, I, I would still recommend it to people, you know, like walk through the process, you know, get, get the understanding of how that works.

Mm-hmm.

But it would, it would strictly be for the experience of it. Yeah. And that's one of the things that I think is evolving in the way that I talk to people about like, okay, you're a hacker. How do we, how do we turn this into a career. So previously I would give that advice. Now I kind of shy away from that advice, but like, how would you want the hacker side to evolve?

That's a really good question. I still think, you know, CVE and CVE equivalents internationally, right, are like advisories just in general. Yeah. CVE has its own set of problems.

Yeah, that's true. So he started talking about a security advisory with your name in the reference. That would be cool.

I'm being very delicate right now. Yes.

Yeah.

Yeah. The idea of like, get your work validated somehow. I think that's still generally good advice. Like the challenge at the moment is that, you know, AI's like, you combine that advice with the ability to use like Agentic, whatever, to do testing submission, blah, blah, blah. And then you think about the fact that that's made a far broader pool of people capable of that. We've kind of got a problem now where it's just like the internet's getting firehosed by this stuff. And by the way, part of the reason for that is that there's a lot of bugs out there as well. It's not purely the fault of the researchers or AI. So there's a bit of a balance to that. I think learning how to, you know, learning how to be polite in some ways in terms of how you—

Soft skills.

How you do that. It's literally soft skills. Like 90%— A lot of us are neurodivergent.

Yeah.

I'm like, yeah, you know, you know what I've been doing for work for the past 30 years. It's like that at scale. Like it's 100% a thing.

There's a certification with CompTIA that is soft skills. Like, just like go literally. Yeah.

Yeah.

No, sometimes like it's funny, man. Sometimes I have to just step back and be like, you know what? I'm gonna go skateboard. I'm gonna go skateboard and like reset.

Emotional regulation.

Yeah.

Like it's, it's the neurodiversion aspect. It's the like deeply passionate and tenacious kind of hacker core DNA side of things. Um, I think, you know, like we get pissed off when we see a thing that's broken that matters, that should be fixed. And people don't understand that. And that's the real world, like teaching people to understand how to actually still feel that, that's fine. But now what do you do with that? How do you actually make it productive? That's a, that can be a journey sometimes.

There's a lot of people who also just like have a strict rule adherence.

Yeah.

And it's like, I really want to follow the rules. Like there's a huge desire to be like a rule follower, but like when the rules don't exist, you have to like—

This is where I come back to like, how do you, how do you make it clear? Like, Discloser is all about like, how do we create like boilerplate policies and tools for people to be able to make their expectations as clear as possible and to make it safe for everyone involved and to actually compensate for some of the stuff we're talking about right now. Yeah. Like I'm, you know, I'm a. A hacker with a particular, you know, bent or a particular neurodivergence, potentially like empathy might not be my strong suit. We can't count on them getting good at that, right? Nor should we. Like, that's not really, yeah, yeah, you know, their, their responsibility, right? Like, what we can do is make it clear. Um, so to me, those things are just kind of simple. But yeah, going back to what you said, like getting advisories, I think the other side of it is just getting in community.

Yeah.

Like straight up because, you know, that's how you meet people and kind of can network your way into opportunities. But it's also where some of these kind of rough edges we're talking about get, you know, get sanded off over time.

I probably do a lot of the hackerspace.

Yeah. I love, uh, uh, Josh Bresher spun up this Discord called Extended Vulnerability Community, which is EVC. Um, and, uh, he spun it up during the time when like the funding was just uncertain about a year and a half ago. And he was like, hey, you want to be a Discord mod? And I was like, oh, like in my mind I'm like, I never want to again be a Discord mod. But I was like, I was like, sure, sure. Yeah, like, like literally. And, um, it, it has been interesting. Like there's 600 people in there, there's probably like 5 or 10 that are always active, right? And then, but like as I talk to people around RSA, yeah, they're like, oh, we read everything in there. Like you have this set of lurkers that are just observing and soaking in and learning and catching the vibe. Yes. And there's a ton of like, you know, poor communication at times in that channel by me, by others. But like, it is one of those spaces where it's like, wow, I learn a lot. Anytime the biggest thing, you know, running VDP, running a CNA, working with researchers and reverse engineers, The biggest thing I have learned is like, if someone's passionate or pissed off, they're usually really passionate and they know something you don't, right? Um, and you, you like just try and take the anger out of it and, and try and have empathy and understand what they're trying to tell you with their walls of text.

Yeah, 100%.

Um, and, and that's hard, like, because naturally it's like, oh man, I don't want to be around that person. Like, they rant to you, like, uh, yeah, but, but ultimately, like, if you engage and you listen and you ask questions, uh, you can learn so much.

We actually found that it was funny. We had a version of that that we discovered early Bugcrowd because like, you know, what we pretty quickly realized was like, we're effectively a translating service.

Yeah.

Oh yeah, that makes a lot of sense, right?

Like in terms of like emotional intelligence, in terms of actual content, in terms of like English as a second language, blah, blah, blah, all of the different things the translation might mean. We experienced like most of that in the middle. And the bonus is that like the subject matter is like edge cases as a service. So like none of this stuff is meant to be the way it is to begin with. So it's like total white space, right? And kind of fun. Like one of the things that we noticed was that people from a particular part of the world, when they submit a vulnerability, like they came off like aggressive and ranty and Like it was just angry. Like you'd read it and you'd go, uh, unpleasant. Yeah.

Which part of the world?

Uh, no, I'm not doing that. I'm not doing that. Um, but it was a, yeah, it was like, it was a regional, it was a particular regional thing. And it's like, okay, what's going on here? Cause you know, the initial reaction is like, fuck these guys, you know, get upset with it. But at some point the curiosity kicks in and it's like, why is that so consistent? Like what's going on? Um, and then what we noticed is if you pushed back like once but did it respectfully and politely, they'd be like, oh, sorry. And then you could just completely de-escalate the conversation and actually get the job done, right? And what turned out to be happening was that they just expected that's how you needed to talk to wealthy Western companies.

Oh, funny.

In order to get their attention.

Yeah.

Um, and that was like kind of deeply baked into that particular kind of region and culture. I was like, okay, cool. Like that's not, they're not wrong. Yeah. Yeah. Yeah. Right. Like they're not necessarily jerks or wrong or any of that other stuff. This is just a translation issue that we're going to need to design around.

Yeah.

And by the way, there's probably going to be about 1,000 others. Yeah. Which there was. Yeah.

That's one of the things that I see echoed in like the community I'm in is like the community as a like regulation of sorts of like Okay. Like you're talking about if somebody gets spicy or just if somebody's communicating very bluntly, like we just have as a community the ability to temper that and just get curious about it. Because in mine, I've noticed like we have a lot of very passionate people, just like so passionate.

Yeah.

And everybody is just like, God, you know, so-and-so is so like annoying sometimes and all this stuff. But when so-and-so doesn't show up for a couple of weeks, you notice, you notice and you say, hey guy, are you, are you doing all right? Yeah. So we have like a kind of a community of care in that sense, which I like, I think people kind of shied away from community for a while because there was, there, there was the ability to not mess up. Um, for a little bit there. And now like people have the ability to mess up, be corrected and not take it personally. And we move and we evolve.

So, yeah. Well, and I think, you know, like the idea of community, um, like the world's only getting, in general, at like the grand macro level, like the world's only getting spicier and kind of more lonely as we go along, right? So like, I think it's important purely for that part. But like in security, like we're literally dealing with all of the edge cases, like those are our job. So like the idea that individuals, going back to where I started with the whole origin story of Bugcrowd, one person can't do all of that, that's just never going to work. So like our diversity and our community and our ability to actually get over some of this stuff, um, I think is actually critical to the solution, not just like a good thing as people. Wow.

We turned that so warm and fuzzy.

I love that.

I know on the vendor, just to like get it a little bit spicier, a little bit more, um, On the technical side, one of the things that I know from the vendor point of view is there's like the security.txt. Yeah. I'm assuming we're evolving past just having like a security.txt file available in the root of the, you know, websites for how to figure out the vulnerability disclosure process.

Yeah.

So how is that evolving?

So this is something that we've, um, that we've done with Disclose.io as well. Um, it's basically disclose.io/programs. We've gone through and scraped all of that. And, and, you know, really the goal is to have a lookup tool available for everyone to understand, like, is there a policy? Is there a contact URL? Yada yada yada, right? So that's like quick plug for that. Um, but to me, like, Security TXT, like, the two things that you need are a contact page, like a contact method of some sort, email or a web form or platform or whatever, whatever it is you're actually using to receive. Box. Um, and then ideally you've got a policy as well. So it's like, okay, if you do this, we'll do that. Here's our definition of good faith. If you like stay within those lanes, you're fine to do whatever. Um, we don't consider that to be criminal, yada yada.

Um, with that specific wording of like, we will not—

yeah. Oh my— yeah. So like, to actually— and this is going back to the legal stuff I was talking about before, because we got the— we got some good changes done by the DOJ, but There's now 50 states in the US that all have different—

This is true. As a resident of Utah, the internet's weird there.

Exactly. Um, or was it F5, like that guy in Missouri or Louisiana? Like there's just different interpretations of anti-hacking law at the state level as well. So it's still useful and I think pretty important for vendors to make it clear what they consider to be, you know, okay, if you do this stuff, then we know that you're a bad guy. But everything else is cool. Um, same globally. You think about it in Australia, in the UK, and yeah, yeah, yeah, yeah.

And we're seeing more policy distributed, more countries spinning up their own policy.

That's right.

How technical would you recommend those guidelines to be on the vendor side? Because like my brain goes like, hey, if I make a POST request that—

This is, this is where it gets really like, this is where Disclosure has been really fun to work on because the original design thing was like, how do we actually, going back to the whole English as a second language thing I was talking about before, if you've got a volunteer disclosure policy that reads like law and peace, war and peace rather, because lawyers have got at it.

Yeah.

Um, A, like English speakers probably aren't going to understand it, but like someone who's like Hindi or like, you know, Spanish or like there's all of these different kinds of incredible ESL communities that participate in this stuff. They don't know what's okay and what's not okay.

Right.

So you've got to make it as simple as possible, but not, you know, you've got to boil it down and not burn it. This is kind of how I phrase it, which legally is a really tricky thing to do. I think, you know, the big thing with that would be just to be thoughtful in terms of what you include. Because I think the thing I've seen over the last 13 years is, you know, organizations leave the start with this ginormous thing. Or they'll add stuff over time to the point where it gets really bloated.

Yeah, um, you don't want to read a novel to figure out.

One of the things I was curious about is your opinion on like requiring a researcher to sign an NDA, uh, agree to, you know, different legal aspects. Yeah, what's your opinion on that?

So that's a fun one. Um, I think it's completely inappropriate for, for public research. Basically. Like, if, if, um, you know, if the security research has been initiated by the researcher of their own recognizance out there somewhere on the internet, and they're dealing with publicly accessible software or targets, then they own that IP. So the idea of, like, you know, you're signing— you're making them sign a non-disclosure agreement to help you for work that they've already done without, you know, it just, to me, it doesn't make sense. It doesn't make sense to me from a researcher standpoint, but also it's like, it kind of defeats the purpose, right? Because if you're running a VDP or if you're running a public bug bounty program, the entire point is to learn from as many places as you can.

Yeah. You're essentially creating a barrier.

Yeah. And you're kind of penalizing them already. You know, like an NDA is a, it's a restrictive thing. Normally with contracts, there's a give and a get. There's no, get for them.

Yeah, there's no benefit.

Doesn't make any sense. Um, the exception to that is if it's a private program, um, where like the invitation— like if the vendor is initiating the invitation or giving access to do research or whatever.

Yes, they give you the product to go.

I think that's like, it's like if you don't want to participate, don't sign the thing, have a nice day, we'll part as friends. So like that to me And I think part of where this whole thing's gotten confused is those two ideas get conflated, right? Like private testing and just what the internet's already doing. So yeah, hopefully that sums it up. Like if it's happening out there and making its way in, I don't think NDAs are appropriate at all, but I do think they're appropriate and relevant for invited stuff.

Yeah, that makes sense. Another one, similar topic, but public versus private disclosure. Software companies.

How do you mean?

Some companies publish advisories that are public.

Yep.

Some make you log in and you have to be a paying customer.

Oh yeah.

This, it seems like more and more companies are spinning up paywalls recently.

Yeah.

Big companies that require you to be a customer in order to get access to their security advisories.

That's a fun one.

I don't have data behind that, but like, no, no, no, it does seem like some people have been moving a narrative back towards—

Yeah, look, I think as a general— I got to think through how I answer this one because I don't want to trip over any landmines. Yeah, that's all right. I think like as a general principle, like security, like, like trying to hide this stuff. Or put it behind a paywall, like that's inherently fragile.

Right.

Um, and the goal here is antifragility.

Yeah.

So transparency to me is like the ideal approach, period.

Right.

Um, I can understand why some organizations might want to gate, you know, timing or access or different things. And I'm sure there's a million different edge cases that can kind of kick in, but like that as a general, like No, this is how it works in the ideal world. I think using that as a starting point is probably the right thing as opposed to the other way around.

Yeah. That's great.

Hopefully I wendled my way out.

Yeah. I think that's fair. I think we're going to wrap up. Sure. I have just one thing I want to highlight. You have your projects, disclose.io, which is great. And then the other project, the security research Legal Defense Fund. Legal Defense Fund.

Yes.

Yeah.

SRLDF.org. Yeah. So I joined the board with those guys 3 weeks ago now. Phenomenal. It's like myself, Jen Ellis, Harvey Geiger, Kurt Opsahl, and Jim Dempsey. And like we've all been trying to keep hackers out of jail for, you know, 10+ years apiece. Wow. So we put this thing together that's basically a 501(c)(3). And the entire purpose of it is if as a researcher you're being chilled with legal threats. So it's like if you're doing good faith research and someone kind of C&Ds on you or they lawyer up or they do whatever and you don't have the ability to defend yourself, you can apply for a grant and we'll pay for that very effectively. Really cool story from that is the Maltese kids that hacked trains. Oh, um, so, so they got, you know, they were under some pretty heavy kind of charges. Um, we did a $20,000 grant for representation for those guys. They got a presidential pardon, and now there's actually, um, law going up in front of Maltese Congress to change anti-hacking regulation over there. So like, great, there's some cool stuff that's happening. I think the big thing is, you know, for people to know that that's there. Yeah. Because it's one of those, oh, that exists. You know, we're looking for folks that feel like they might be a potential grantee. Obviously looking for folks that want to fund it as well. Yeah.

And most people, legal is just terrifying to navigate. Right. Yeah.

So, well, and it chills, it chills the research from happening in the first place. Yeah. And like, that's dumb. So like, how do we make that less dumb?

Well, thank you so much for everything that you and the people you work with do for the vulnerability disclosure process.

Thank you guys.

Yeah, it's great. Thanks for joining the ThreatCon One podcast. We'll see you on the next episode of Third Count One.