5

I asked a question that is currently put on hold as it is considered primarily opinion-based.

According to what's on topic here, this includes incident response, policies, risk management. This question is asking for security best practices for a small company. Other questions have asked about best practices and are not closed/on hold.

What is a way that I can improve this question so that it is not on hold?

7
  • 2
    Generally speaking on SE sites, using the word "Best" in a question will imply seeking opinion. Asking for good practice, without specifying best is usually better received.
    – Chenmunka
    Commented Jul 11, 2017 at 8:48
  • 1
    @Chenmunka See, this is what's annoying about the StackExchange network. The people that marked the question on hold can't see that "Best" and "Good Practice" a very similar? Rather than cutting through that to help answer the question, the question gets nitpicked.
    – Startup Security
    Commented Jul 11, 2017 at 14:08
  • "Best" implies that there is exactly one answer. "Good practice" does not.
    – CalculatorFeline
    Commented Jul 11, 2017 at 16:31
  • 2
    @CalculatorFeline That is just being pedantic...
    – Startup Security
    Commented Jul 11, 2017 at 17:34
  • I've submitted an edit for approval because I am interested in the answer
    – flerb
    Commented Aug 7, 2017 at 19:58
  • Best practices are often bad because it makes people asking for generic solution to generic problems, which is not what you're facing when you come ask a question here. You face a specific problem and you want a solution that fit to solve your problem and sometimes, "best practices" does not solve your problem. Furthermore, the real problem of your question seems more about workplace/management than security. You are asking basically what kind of policy you should set up to compensate people that report defects. The answer will be mostly "it depends of what your management is willing to pay".
    – Walfrat
    Commented Aug 17, 2017 at 11:47
  • Basically a good practices and generic here could be what google do : competition with "100k$ reward ", but the fact is that you don't have that money, so you have to set up something that fit in your company budget.
    – Walfrat
    Commented Aug 17, 2017 at 11:48

2 Answers 2

Reset to default
1

It's a good question but I voted to close it because I did not see a definitive non-opinion based answer as a possible outcome.

If you look closely at bounty programs of multiple companies you could see slight or even big differences. This is because they had to make a program that worked for them. There just isn't (as far as we know) an end all bug bounty program that will satisfy all businesses and all researchers. This is basically a practice drafted to cater to best work for them to achieve the goal they are looking to achieve with the resources they have available. But it isn't a standard practice. As a result the answers you would receive would be primarily opinion based with no guarantee it would work for you.

0

In my opinion this is a very interesting, good, but possibly misworded, question.

The problem, as mentioned in the comments is that you will never get a definitive answer for this question, and rephrasing it so as not to encourage a definitive answer prevents answerers from having to begin with "I know that this is perhaps not the best possible answer but one solution might be..."

I think the original question could be edited to fit Security SE's guidelines by rephrasing it to something along the lines of 'What are some options for a small company on a budget to maintain a bug bounty program?'.

1
  • 1
    I do not see how this improves things. "I know that this is perhaps not the best possible answer" now becomes "I know that this is perhaps not the best possible option", this remains a opinion-based question. Sadly, this is a limitation of the format chosen by StackExchange that it does no suits open questions (and they want to keep things this way to differentiate themselves from other similar websites and forums). Even good and interesting open questions remain open questions where it is difficult to formulate a definitive answer and, therefore, do not match the Q&A format.
    – WhiteWinterWolf
    Commented Aug 8, 2017 at 9:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .