7 ms·

http://help.getpocket.com/customer/portal/articles/1225832-pocket-security-overview http://help.getpocket.com/customer/portal/articles/1225832-p... "Pocket doe

http://help.getpocket.com/customer/portal/articles/1225832-pocket-security-overview http://help.getpocket.com/customer/portal/articles/1225832-p... "Pocket does not provide monetary compensation for any identified or possible vulnerability." Cheapskates. This could have cost them money if somebody abusive had discovered it first. He deserves a monetary award. [edit] Should we be concerned about the massive number of people listed on that page who have found security problems with Pocket? I counted 153 separate people...

misterjinx 11y ago
was going to ask about the bounty and then saw this. bummer.
drzaiusapelord 11y ago
>He deserves a monetary award. Heaven forbid, people submit security issues because they want to be helpful or care about the project.
- Mikushi 11y ago
  Heaven forbid we ask of a corporation that they compensate us for a job they should have done and preventing huge losses and a PR nightmare. Had I been OP I would have sold the exploits with no remorse, we don't need companies like that on the market, rewarding corporations for bad behaviour with free labour is fucked up on every level.
  - mrestko 11y ago
    You would have committed a felony?
    - SCHiM 11y ago
      Depending on where OP lives, that might not have been a felony. I'm pretty sure that in my country I can sell whatever software I want, as long as I brand it as 'automatic patch management testing' or something...
    - mbrutsch 11y ago
      Seriously? In America today, just releasing balloons into the air is a felony: http://www.cbsnews.com/news/anthony-brasfield-fla-man-charged-after-releasing-balloons-into-sky-report-says/ http://www.cbsnews.com/news/anthony-brasfield-fla-man-charge... That word has lost all weight, right along with "terrorist".
      - mrestko 11y ago
        Okay, so forget the word felony. "You would have aided/abetted a malicious criminal and profited monetarily by doing so?" My point is that selling an exploit doesn't become morally okay just because the company doesn't offer a bounty.
        forgotmypassw 11y ago
        Except that morality is highly subjective and some people would be completely fine commiting a criminal activity just for the hell of it.
        tertius 11y ago
        You say it's subjective and then the reason you give is that some people would, knowing that it's criminal, still commit a crime. It looks like their view of the activity isn't that it's fine to do, rather that they don't care that it's not fine. This implies that they know and accept that it's not fine.
      - enlightenedfool 11y ago
        I don't know what to say after reading this. Did the act come into force after BP spill?
  - coldpie 11y ago
    Maybe they should have a bounty program, but they don't, and they made that clear. They didn't ask anyone to perform "free labor," and I don't think they have any obligation to pay for labor they didn't ask to be performed. I don't see anything unethical in their behavior. Your beef seems more to be with the researcher who decided to perform free labor for this company. Selling exploits to the black market does strike me as unethical, though.
    - Ntrails 11y ago
      >Selling exploits to the black market does strike me as unethical, though. If I gave them away and they get exploited is it unethical? If I gave them away publicly vs privately does it make a difference? If I responsibly reported to the manufacturer a month previously? I guess intent matters, and I'm ok with that being the line. In the end though I feel the rewards for fast production far outweigh the consequences of security bugs. My firefox updated last night and added pocket and I was reminded that I couldn't even remove the useless bloody thing.
      - coldpie 11y ago
        > If I responsibly reported to the manufacturer a month previously? I'm not an expert on responsible disclosure, and I think reasonable people can disagree on the best course of action. I think selling exploits on the black market is always unethical. > I couldn't even remove the useless bloody thing. Right click, "Remove from toolbar".
    - tptacek 11y ago
      The black market does not want serverside Pocket vulnerabilities. These bugs only have value to Pocket.
  - tertius 11y ago
    I'm a photographer and freelance software developer, I know all about not doing work for free and what that does to our industries. This isn't doing work for free, this is a hobby. The time spent by this person was not requested by Pocket and they shouldn't be maligned just because they're not paying him. Also, "sold the exploits with no remorse" really makes you sound like a troll. So I'm feeding.
  - jerf 11y ago
    If you're that worried about compensation, the correct answer is to determine up front whether there's a bounty program, and if not, move on. Not to do work you had every reason to believe would not be compensated, then complain when it isn't compensated.
  - eli 11y ago
    You can ask them for a bounty program in the future, but you don't really have a right to get upset when they don't honor a bounty that was never promised. It's like demanding a reward for returning a dropped wallet.
  - eli 11y ago
    So can I correct the grammar on your website and then send you an invoice? If you want to get paid for your security work, you should convince someone to hire you, not work on spec for someone who did not hire you.
alimbada 11y ago
It's a freemium service that doesn't depend on ad revenue. Maybe they're not made of money as Facebook and Google are and that's the reason for not compensating.
- mike-cardwell 11y ago
  Here's a picture of their current team: https://getpocket.com/jobs https://getpocket.com/jobs - Here's a list of 7 other positions they're currently hiring for - https://boards.greenhouse.io/pocket https://boards.greenhouse.io/pocket This isn't some free service being run out of the goodness of somebodys heart. This is a company, that wants to make money. If a company has that many employees, they can afford a bug bounty program too.
  - balladeer 11y ago
    Not to forget the data they are getting: 1. What people are reading 2. What they will read 3. What they have read 4. What they are just bookmarking/RILing and not reading 5. Etc etc. That's valuable data imho.
  - semi-extrinsic 11y ago
    > they can afford a bug bounty program too Maybe they're just being evil, you know, like Oracle.
  - alimbada 11y ago
    I didn't say it was being run out of the goodness of someone's heart. That's why they need money, to pay the bills. Having infrastructure to deal with that many users on a popular service doesn't come cheap.
- muP 11y ago
  I disagree. Mozilla signs a very rich contract with search engines like Google and Yahoo. They have more money than they know what to do with.
  - detaro 11y ago
mst 11y ago
I think that number being high, if anything, demonstrates that they don't currently need to provide monetary compensation.
eli 11y ago
When you perform unsolicited work, you shouldn't expect to get paid for it.
- danielweber 11y ago
  Yes. Notice the corollary: if they had a bug bounty, we wouldn't be learning about this today, because someone who wants to make money probably would have already found them. You shouldn't do work based on "they haven't had a bug bounty before now but maybe they will make one just for me."
wcummings 11y ago
Exploits in a proprietary cloud service like this are harser to sell, at least se acquisition programs are expressly uninterested in them. I wonder what effect that has on bug bounties
bluedevilzn 11y ago
Apple, the world's most valuable company, doesn't have a bug bounty program either.
- beedogs 11y ago
  They also don't really seem to put much effort into releasing bugfixes in a timely manner. For a month and a half, you could reboot any iPhone in the world remotely via text message.
  - daemin 11y ago
    In some strange way that (non ironically) sounds like a feature.

misterjinx 11y ago

was going to ask about the bounty and then saw this. bummer.

drzaiusapelord 11y ago

>He deserves a monetary award. Heaven forbid, people submit security issues because they want to be helpful or care about the project.

Mikushi 11y ago
Heaven forbid we ask of a corporation that they compensate us for a job they should have done and preventing huge losses and a PR nightmare. Had I been OP I would have sold the exploits with no remorse, we don't need companies like that on the market, rewarding corporations for bad behaviour with free labour is fucked up on every level.
- mrestko 11y ago
  You would have committed a felony?
  - SCHiM 11y ago
    Depending on where OP lives, that might not have been a felony. I'm pretty sure that in my country I can sell whatever software I want, as long as I brand it as 'automatic patch management testing' or something...
  - mbrutsch 11y ago
    Seriously? In America today, just releasing balloons into the air is a felony: http://www.cbsnews.com/news/anthony-brasfield-fla-man-charged-after-releasing-balloons-into-sky-report-says/ http://www.cbsnews.com/news/anthony-brasfield-fla-man-charge... That word has lost all weight, right along with "terrorist".
    - mrestko 11y ago
      Okay, so forget the word felony. "You would have aided/abetted a malicious criminal and profited monetarily by doing so?" My point is that selling an exploit doesn't become morally okay just because the company doesn't offer a bounty.
      - forgotmypassw 11y ago
        Except that morality is highly subjective and some people would be completely fine commiting a criminal activity just for the hell of it.
        tertius 11y ago
        You say it's subjective and then the reason you give is that some people would, knowing that it's criminal, still commit a crime. It looks like their view of the activity isn't that it's fine to do, rather that they don't care that it's not fine. This implies that they know and accept that it's not fine.
    - enlightenedfool 11y ago
      I don't know what to say after reading this. Did the act come into force after BP spill?
- coldpie 11y ago
  Maybe they should have a bounty program, but they don't, and they made that clear. They didn't ask anyone to perform "free labor," and I don't think they have any obligation to pay for labor they didn't ask to be performed. I don't see anything unethical in their behavior. Your beef seems more to be with the researcher who decided to perform free labor for this company. Selling exploits to the black market does strike me as unethical, though.
  - Ntrails 11y ago
    >Selling exploits to the black market does strike me as unethical, though. If I gave them away and they get exploited is it unethical? If I gave them away publicly vs privately does it make a difference? If I responsibly reported to the manufacturer a month previously? I guess intent matters, and I'm ok with that being the line. In the end though I feel the rewards for fast production far outweigh the consequences of security bugs. My firefox updated last night and added pocket and I was reminded that I couldn't even remove the useless bloody thing.
    - coldpie 11y ago
      > If I responsibly reported to the manufacturer a month previously? I'm not an expert on responsible disclosure, and I think reasonable people can disagree on the best course of action. I think selling exploits on the black market is always unethical. > I couldn't even remove the useless bloody thing. Right click, "Remove from toolbar".
  - tptacek 11y ago
    The black market does not want serverside Pocket vulnerabilities. These bugs only have value to Pocket.
- tertius 11y ago
  I'm a photographer and freelance software developer, I know all about not doing work for free and what that does to our industries. This isn't doing work for free, this is a hobby. The time spent by this person was not requested by Pocket and they shouldn't be maligned just because they're not paying him. Also, "sold the exploits with no remorse" really makes you sound like a troll. So I'm feeding.
- jerf 11y ago
  If you're that worried about compensation, the correct answer is to determine up front whether there's a bounty program, and if not, move on. Not to do work you had every reason to believe would not be compensated, then complain when it isn't compensated.
- eli 11y ago
  You can ask them for a bounty program in the future, but you don't really have a right to get upset when they don't honor a bounty that was never promised. It's like demanding a reward for returning a dropped wallet.
- eli 11y ago
  So can I correct the grammar on your website and then send you an invoice? If you want to get paid for your security work, you should convince someone to hire you, not work on spec for someone who did not hire you.

alimbada 11y ago

It's a freemium service that doesn't depend on ad revenue. Maybe they're not made of money as Facebook and Google are and that's the reason for not compensating.

mike-cardwell 11y ago
Here's a picture of their current team: https://getpocket.com/jobs https://getpocket.com/jobs - Here's a list of 7 other positions they're currently hiring for - https://boards.greenhouse.io/pocket https://boards.greenhouse.io/pocket This isn't some free service being run out of the goodness of somebodys heart. This is a company, that wants to make money. If a company has that many employees, they can afford a bug bounty program too.
- balladeer 11y ago
  Not to forget the data they are getting: 1. What people are reading 2. What they will read 3. What they have read 4. What they are just bookmarking/RILing and not reading 5. Etc etc. That's valuable data imho.
- semi-extrinsic 11y ago
  > they can afford a bug bounty program too Maybe they're just being evil, you know, like Oracle.
- alimbada 11y ago
  I didn't say it was being run out of the goodness of someone's heart. That's why they need money, to pay the bills. Having infrastructure to deal with that many users on a popular service doesn't come cheap.
muP 11y ago
I disagree. Mozilla signs a very rich contract with search engines like Google and Yahoo. They have more money than they know what to do with.
- detaro 11y ago

mst 11y ago

I think that number being high, if anything, demonstrates that they don't currently need to provide monetary compensation.

eli 11y ago

When you perform unsolicited work, you shouldn't expect to get paid for it.

danielweber 11y ago
Yes. Notice the corollary: if they had a bug bounty, we wouldn't be learning about this today, because someone who wants to make money probably would have already found them. You shouldn't do work based on "they haven't had a bug bounty before now but maybe they will make one just for me."

wcummings 11y ago

Exploits in a proprietary cloud service like this are harser to sell, at least se acquisition programs are expressly uninterested in them. I wonder what effect that has on bug bounties

bluedevilzn 11y ago

Apple, the world's most valuable company, doesn't have a bug bounty program either.

beedogs 11y ago
They also don't really seem to put much effort into releasing bugfixes in a timely manner. For a month and a half, you could reboot any iPhone in the world remotely via text message.
- daemin 11y ago
  In some strange way that (non ironically) sounds like a feature.