Yet another Hacker News

ChatGPT silently passes data between connectors and the bounty wants an ID card

36 points Aldipower 59 minutes ago 9 comments

simonw 39 minutes ago | parent

I assumed that the ID requirement was about sanctions compliance - OpenAI can't legally send money to someone in North Korea, for example.

But https://docs.bugcrowd.com/researchers/managing-account/accou... says:

> To improve platform integrity by reducing high volumes of low-quality submissions, identity verification (IDV) is now mandatory for all researchers before submitting reports to Managed Bug Bounty (MBB) programs (public and private, excluding on-demand MBBs).

appplication 34 minutes ago | parent

On one hand, this is valid. On the other hand, security researchers can be some uber-paranoid weirdos who prefer to be entirely anonymous, and this could have a chilling effect.

Net net it’s probably positive it’s just too easy to spam these otherwise.

kccqzy 17 minutes ago | parent

The kind of security researchers who prefer to be entirely anonymous are not seeking monetary rewards from big bounties. No company would pay such researchers anonymously (like using Monero).

edot 11 minutes ago | parent

They use Persona, which is heavily invested-in by Peter Thiel's Founder's Fund. Peter Thiel, of Palantir (funded initially by In-Q-Tel, the CIA's VC arm). No shit security researchers don't want to give ID scans and biometric data to them.

uptrails 24 minutes ago | parent

No. All bounty programs allowed submissions without ID, compliance came into play only if you were given a reward and decided to accept it.

This was moved to the front of the reporting process specifically to combat AI-generated vuln report spam - basically, requiring you to "burn" your real ID if you're submitting slop. Kinda ironic that this is now preventing people from submitting security reports to AI companies.

kristjansson 38 minutes ago | parent

This seems like a fundamental misunderstanding / over estimation of the guarantees OAI and MCP can offer. If 'confirmation' is a separate tool call ... it's a separate tool call. There's no scoping, there's no 'binding', nothing. When you hand control back to the model you hand control back to the model.

orf 25 minutes ago | parent

Why did “techsoft.ye” feel the need to reply with a lengthy LLM comment that contained nothing useful at all?

fwlr 17 minutes ago | parent

I felt it was of a similar length, effort, and usefulness to the original post. “I observed something I didn’t like” and “I observed what you said”.