Bug Hunters' Perspectives on the Challenges and Benefits of the Bug Bounty Ecosystem
Bug Hunters' Perspectives on the Challenges and Benefits of the Bug Bounty Ecosystem
复制标题
DOI：
10.48550/arxiv.2301.04781
复制
发表时间：
2023-01
期刊：
影响因子：
--
通讯作者：
Omer Akgul;Taha Eghtesad;A. Elazari;O. Gnawali;Jens Grossklags;Michelle L. Mazurek;Daniel Votipka
中科院分区：
文献类型：
--
作者：
Omer Akgul;Taha Eghtesad;A. Elazari;O. Gnawali;Jens Grossklags;Michelle L. Mazurek;Daniel Votipka
尽管研究人员已经从平台和程序的角度描述了bug赏金生态系统的特征，但很少有人去理解主要工作者的观点：bug猎人。为了提高bug奖励，重要的是要了解猎人的激励因素，挑战和整体利益。我们通过三项研究来解决这一研究差距：通过自由列表调查（n=56）确定关键因素，用大规模因素评级调查（n=159）对每个因素的重要性进行评级，并进行半结构化访谈以揭示细节（n=24）。在bug猎人列出的54个因素中，我们发现奖励和学习机会是最重要的好处。此外，我们发现范围是程序之间的最大区别。令人惊讶的是，我们发现获得声誉是猎人最不重要的动机之一。在我们发现的挑战中，沟通问题（例如反应迟钝和争议）是最严重的。我们提出建议，使bug赏金生态系统适应更多的bug猎人，并最终增加在一个未充分利用的市场的参与。
Although researchers have characterized the bug-bounty ecosystem from the point of view of platforms and programs, minimal effort has been made to understand the perspectives of the main workers: bug hunters. To improve bug bounties, it is important to understand hunters' motivating factors, challenges, and overall benefits. We address this research gap with three studies: identifying key factors through a free listing survey (n=56), rating each factor's importance with a larger-scale factor-rating survey (n=159), and conducting semi-structured interviews to uncover details (n=24). Of 54 factors that bug hunters listed, we find that rewards and learning opportunities are the most important benefits. Further, we find scope to be the top differentiator between programs. Surprisingly, we find earning reputation to be one of the least important motivators for hunters. Of the challenges we identify, communication problems, such as unresponsiveness and disputes, are the most substantial. We present recommendations to make the bug-bounty ecosystem accommodating to more bug hunters and ultimately increase participation in an underutilized market.