3 ms·
Correct, the policy isn't clear and needs improvement. The bug bounty's policy definitely falls under the CSO's purview. So even if you approve of Alex's handli
by scurvy 11y ago
Correct, the policy isn't clear and needs improvement. The bug bounty's policy definitely falls under the CSO's purview. So even if you approve of Alex's handling of the matter, you can't forgive him for running a sloppy bug bounty program. It's one thing if he claims mea culpa and says we could do better. But there's not one iota of regret, remorse, or apology on not making things more clear in Alex's response.
If you're going to persecute someone on details, you had better make sure your policy is very detailed, not vague, and not left open to interpretation. In this regard, Mr. Stamos failed.
- aaronchall 11y agoThe policy reads clear enough to me to warrant a huge reward. Adding additional conditions after the fact is dealing in bad faith.
- xanderjanz 11y agomost RCE bugs can be compounded into major data dumps. That doesn't make each individual RCE a million dollar bug.
- itsthecourier 11y agoThink about this guy being a Russian hacker and selling the ability to access restricted accounts, pose as Instagram administrator and I assume access user's data freely
- tajen 11y agoEvery RCE that could have been sold on the black market for a million dollars is worth almost the same reward (modulo the advantage of being legal).