{"vulnerability": "cve-2020-8450", "sightings": [{"uuid": "199d37c0-8f02-419d-afce-a3207853dfd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8450", "type": "seen", "source": "https://t.me/hn_best_comments/2671", "content": "Re: We found six critical PayPal vulnerabilities, and ...\n        \nHackerOne appears to be completely broken and I wouldn't recommend it to anyone.\n\nDisagreements are to be expected on a bug bounty platform, but these days they just stop responding altogether and don't pay. It borders on outright fraud.\n\nI've been trying to report a Squid RCE (CVE-2020-8450) since October. The Squid maintainers seemed unprepared for dealing with the report as they kept being unresponsive and it took 2 months to merge my patch. Maybe they're volunteers, so I can't blame them. Reported it to the bug bounty [1] which promises high rewards on January 20th and apart from triaging it, there has been radio silence since despite having invoked HackerOne mediation. I have more Squid memory bugs and I'd rather rm -rf them than go through this process again.\n\nHackerOne used to be decent but this appears to be a structural problem now [2].\n\n[1] https://hackerone.com/ibb-squid-cache\n[2] https://twitter.com/DevinStokes/status/1228014268567547905\n        \nguidovranken, 3 hours ago", "creation_timestamp": "2026-07-29T12:01:07.325078Z"}]}