4 ms·

Another grumbly hacker complaining about a bug bounty undervaluing their work. It wasnt long ago that notifying a company that they had a vuln was an act that

Another grumbly hacker complaining about a bug bounty undervaluing their work. It wasnt long ago that notifying a company that they had a vuln was an act that risked prosecution. Bug bounties are a release valve. They are not a substitute for a job. They will never pay the same as crime. Writeups like this are not going to facilitate relationships with leaders in the security industry. This post and others like them are embarrassingly naive.

tomjen3 10y ago
Who cares about "facilitating relationships"? Thats a load of bullshit words. They offered an amount of money in exchange for some information, then neglected their responsibility. Yeah you used to risk prosecution for doing stuff like that, then the site owners realized how brain dead that was and now they are trying to have a normal relationship because it is a huge bonus for them, not because they give a shit about the people who helped them out.
corndoge 10y ago
Money is money. Offer $25k and a researcher gets RCE on the vast majority of your scoped boxes, you better pay a substantial portion of that $25k. Shame on PornHub, I'll be using xvideos from now on.
tshadwell 10y ago
That's an amazingly regressive point of view. Sure, in the past such things risked prosecution but why exactly does it mean we have to figuratively knock stones together on vulnerability ethics? When cars were invented, a man had to run in front of the car with a red flag to warn others of it. In 2016, everyone deserves privacy and security on the internet. We know and understand the dangers of vulnerabilities better, and I think we should be capable of having some respect and suitably compensating those who do the right thing. If you can make the internet a more secure place for us to live our lives and make enough to live out of it, more power to you.
ryanlol 10y ago
This would make sense if selling such bugs was explicitly illegal, but it isn't.

tomjen3 10y ago

Who cares about "facilitating relationships"? Thats a load of bullshit words. They offered an amount of money in exchange for some information, then neglected their responsibility. Yeah you used to risk prosecution for doing stuff like that, then the site owners realized how brain dead that was and now they are trying to have a normal relationship because it is a huge bonus for them, not because they give a shit about the people who helped them out.

corndoge 10y ago

Money is money. Offer $25k and a researcher gets RCE on the vast majority of your scoped boxes, you better pay a substantial portion of that $25k. Shame on PornHub, I'll be using xvideos from now on.

tshadwell 10y ago

That's an amazingly regressive point of view. Sure, in the past such things risked prosecution but why exactly does it mean we have to figuratively knock stones together on vulnerability ethics? When cars were invented, a man had to run in front of the car with a red flag to warn others of it. In 2016, everyone deserves privacy and security on the internet. We know and understand the dangers of vulnerabilities better, and I think we should be capable of having some respect and suitably compensating those who do the right thing. If you can make the internet a more secure place for us to live our lives and make enough to live out of it, more power to you.

ryanlol 10y ago

This would make sense if selling such bugs was explicitly illegal, but it isn't.