Yet another Hacker News

ChatGPT silently passes data between connectors and the bounty wants an ID card

37 points Aldipower 1 hour ago 10 comments

simonw 41 minutes ago | parent

I assumed that the ID requirement was about sanctions compliance - OpenAI can't legally send money to someone in North Korea, for example.

But https://docs.bugcrowd.com/researchers/managing-account/accou... says:

> To improve platform integrity by reducing high volumes of low-quality submissions, identity verification (IDV) is now mandatory for all researchers before submitting reports to Managed Bug Bounty (MBB) programs (public and private, excluding on-demand MBBs).

appplication 36 minutes ago | parent

On one hand, this is valid. On the other hand, security researchers can be some uber-paranoid weirdos who prefer to be entirely anonymous, and this could have a chilling effect.

Net net it’s probably positive it’s just too easy to spam these otherwise.

kccqzy 19 minutes ago | parent

The kind of security researchers who prefer to be entirely anonymous are not seeking monetary rewards from big bounties. No company would pay such researchers anonymously (like using Monero).

edot 13 minutes ago | parent

They use Persona, which is heavily invested-in by Peter Thiel's Founder's Fund. Peter Thiel, of Palantir (funded initially by In-Q-Tel, the CIA's VC arm). No shit security researchers don't want to give ID scans and biometric data to them.

uptrails 26 minutes ago | parent

No. All bounty programs allowed submissions without ID, compliance came into play only if you were given a reward and decided to accept it.

This was moved to the front of the reporting process specifically to combat AI-generated vuln report spam - basically, requiring you to "burn" your real ID if you're submitting slop. Kinda ironic that this is now preventing people from submitting security reports to AI companies.

lrvick 5 minutes ago | parent

Pay anonymous whitehats for their time or you end up with more anonymous blackhats.

Security researchers in desperate situations will choose to feed their families over respecting US law if forced to choose.

kristjansson 40 minutes ago | parent

This seems like a fundamental misunderstanding / over estimation of the guarantees OAI and MCP can offer. If 'confirmation' is a separate tool call ... it's a separate tool call. There's no scoping, there's no 'binding', nothing. When you hand control back to the model you hand control back to the model.

orf 27 minutes ago | parent

Why did “techsoft.ye” feel the need to reply with a lengthy LLM comment that contained nothing useful at all?

fwlr 19 minutes ago | parent

I felt it was of a similar length, effort, and usefulness to the original post. “I observed something I didn’t like” and “I observed what you said”.