What happened to HackerOne with Joel Margolis (Ep.189)

BLUF: Former Critical Thinking co-host Joel returns after ~5 years to discuss his viral blog post criticizing HackerOne's drift from its grassroots, hacker-centric roots, covering platform stagnation, HSM advantages, AI data-usage controversies, and how HackerOne can win back its "golden era" identity 1:26, 4:25.

Key Takeaways:
• HackerOne's CEO responded to Joel's criticism in advance, acknowledging good points and saying she owns fixing how community feedback is exchanged and actioned 1:26-2:00
• Joel contrasts the grassroots "golden era" (custom Angry Blue LHE posters, founder accessibility, community events) with today's cheaper, more manufactured feel; he attributes the shift partly to natural company lifecycle but also to mistakes in resourcing and lost institutional knowledge 5:31-8:53
• On the HSM program, Joel doesn't want it gone but argues it creates unfair advantages (direct staff access) for top hackers; Justin counters that new hackers like Spaceracoon still rise, so success isn't impossible for newcomers 17:37-21:05
• A core complaint: power-user feedback goes unanswered despite AI making small fixes trivially easy—Joel cites a filter request he prototyped himself in an hour that remains unimplemented after two years 22:25-27:27
• On AI and report data, Joel's demand is internal alignment and transparency: HackerOne denied using researcher reports, then launched a product citing "your prior H1 bounty findings"; he wants clear answers and an opt-out button 47:06-52:27
• Both hosts note triage is an almost impossible chicken-and-egg problem—skilled triagers just leave to do bug bounty—and agree whoever cracks it (e.g., via approaches like Meta's FBDL) will gain a major competitive edge 1:03:00-1:07:35
• Despite the criticism, the episode closes with deep gratitude: the platforms accomplished their mission of a safe space to hack, and Joel wants HackerOne to recapture its 2017-era community appreciation 1:12:59-1:13:27

The episode balances pointed critique of HackerOne's resource allocation, sales emphasis, and communication failures with genuine nostalgia and a constructive roadmap: recenter on hackers, act on feedback, and fix triage.

Sources:

• 1:26 HackerOne CEO's written response to Joel's blog post criticism
• 4:25 Joel explains the impetus behind the blog post
• 5:31 Reflections on HackerOne's golden era vs. today
• 17:37 Debate over the HSM program and new-hacker opportunity
• 22:25 Frustration over ignored power-user feedback and platform stagnation
• 47:06 AI/report-data controversy and demand for transparency and opt-out
• 1:03:00 Triage as an unsolved scaling and incentive problem