Hackerone (where cURL hosted their bounty program) tracks the reputation of bounty hunters. I don't understand why they are not taking advantage of this. Make a private program, invite only hackers who have proved themselves by submitting relevant reports.
Yes I meant simple as in "amateur mistakes". From the mistakes (and their excitement and response to the report) they are clueless about security. Which of course is bad. Hopefully they will take security more seriously on the future.
Cool post. One thing that rubbed me the wrong way: Their response was better than 98% of other companies when it comes to reporting vulnerabilities. Very welcoming and most of all they showed interest and addressed the issues. OP however seemed to show disdain and even combativeness towards them... which is a shame. And of course the usual sinophobia (e.g. everything Chinese is spying on you).
Overall simple security design flaws but it's good to see a company that cares to fix them, even if they didn't take security seriously from the start.
This reminds me of my teenage years, when I was considering going into aerospace engineering to work on military aircraft. But I was immensely conflicted between the feelings of "This is where all the coolest tech is" and "I would be building murdering machines".
The pacifist side won and decades later I feel good about the decision. I managed to find other work that stimulated my curiosity without having to be part of immense suffering.
Also curious to hear about their thoughts, specially from those employees who have a firm anti-fascist belief. I would 100% be considering my resignation if I were in their position.
I'm not a left winger just anti-fascist; and I posted the question because I am curious about the thoughts of the employees. I don't want to discuss the gesture. There's a lot of discussion here about work environment and career decisions and this is what I was asking about. I think it was a valid question and a shame it got self-censored by part of the community.
There's a lot of discussion here about work environment and startup culture and I thought it was a valid question to current SpaceX and Tesla employees. I am genuinely curious and thought HN would be the best place to ask this and get some genuine answers.