“Bug bounty programs have been surprisingly effective and I don’t see this being any different for Tesla. I think they’re smart to start with their website as they learn how to handle the influx of security bug reports. As they mature, they may eventually decide to extend the program to vehicles and more critical systems, but I wouldn’t expect it to happen very soon. Letting people play around with the website is one thing, letting them attack a vehicle is a whole different matter.
These bug-bounty programs are getting real value, but there are costs too. There are many reported flaws that are not actually vulnerabilities. It takes work to track these down and deal with them. Most of these programs are run by organizations with a small number of very critical applications. I strongly recommend these programs as part of a balanced application security breakfast. I hope Tesla has done as much security work as they can before this launch. But once they've reached the limit of their security abilities, why not get some help from the rest of the planet. The planet is doing the hacking anyway… all they want is a little recognition.
I’m sure that Tesla will get value from the program, but I consider bug bounty programs a nice-to-have part of an application security program. The real assurance comes from secure coding and verification processes across the software development lifecycle.”
