TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Ask HN: How to handle security researchers with fuzzers and other toolkits

3 pointsby petecooperover 3 years ago
I am involved with an open source CMS project. Part of my role is triaging incoming emails to our project inbox. A gradually increasing percentage of these emails come from security researchers, advising us of issues they&#x27;ve found. We&#x27;ve had an uptick in overall volume this year after a crypto-funded bug bounty site appeared, found us, and a slew of reports landed. The majority of these reports weren&#x27;t issues – rather, they can be summarised as &quot;an administrator can do administrator-level stuff&quot; within the CMS. We don&#x27;t consider these vulnerabilities, and we say as much in our security statement.<p>More recently, we have had an increase in researchers with fuzzers, toolkits and other rapid-fire stuff. Around 90% of these researchers are focussed on getting a CVE. With the reports we receive, it&#x27;s rare for a researcher to include a proof of concept, even after we politely request. It&#x27;s typical for this type of researcher to say there&#x27;s a problem with file X in directory Y, and btw please can I have a CVE now for my research project &#x2F; wall &#x2F; work promotion &#x2F; and so on.<p>I&#x27;m not sure how this sits with me. Researchers who provide info, PoC code, and sometimes even a resolution are very straightforward to deal with – and hugely appreciated. My gut feeling with the fuzzer-type researcher is that they&#x27;re taking the spray-and-pray approach as CVE or beg bounty hunters, and that&#x27;s less clear cut from a comms point of view. I don&#x27;t want to be getting into semantics with those researchers who have vague reports (minus the PoC) but are still adamant they want a CVE trophy, where essentially they&#x27;ve run a third-party tool that says &quot;there might be a problem here, not 100% sure&quot;.<p>I&#x27;d love to hear your advice on this. What could be done to make this situation more tenable?<p>Off the top of my head:<p>* bump up the security content on our website so it&#x27;s more obvious what we&#x27;re looking for (and by extension, what we&#x27;re not looking for)<p>* learn how fuzzers work and do the fuzzing ourselves<p>What else might work?

1 comment

garmaineover 3 years ago
Circular filing bin. Not worth your time to respond to low effort stuff like this.