3 ms·

I think $5,000 is a lot of money. I'd be pretty happy if they sent that to me. In years past, companies would just give you a nice pat on the back.

andkenneth 10y ago
Right, but this is facebook, and it's breaking auth. This is the company that said that if there's a million dollar bug, they will pay out for it. I'm not saying this is a million dollar bug, but breaking auth is up there on things that are bad and is probably worth a bit more than 5k.
stephengillie 10y ago
What if someone else was offering $10,000 for Facebook bugs, so they could exploit them? This bug could probably result in more than $5,000 in damages to the Facebook brand.
- argonaut 10y ago
  But someone isn't. That's the point. These bugs don't go for $10k on the black market.
  - rl3 10y ago
    That's odd considering the potential monetary damage of such bugs can far exceed $10k.
    - XMPPwocky 10y ago
      One can smash a car up with a sledgehammer. Is the value of a sledgehammer equal to the value of a car?
      - deleted 10y ago
        [deleted]
      - rl3 10y ago
        >Is the value of a sledgehammer equal to the value of a car? My previous post was poorly worded; I didn't mean to imply equality. To use your analogy, valuing a serious vulnerability on a platform that has 1.65B users in the $5-10k range is tantamount to selling a 30lb sledge hammer for a dollar.
        ponyfleisch 10y ago
        But what if producing a sledgehammer only cost 50 cents? Then people would sell sledgehammers for a dollar or less.
        rl3 10y ago
        Rather than torture this analogy further: Obviously exploit pricing is generally efficient and adheres to free market principles. That said, it's hypothetically possible that an exploit against a large tech company could sell for far more if the circumstances are right, considering the price to damage ratio is so skewed in addition to the unique nature of each exploit. Therefore, large tech companies don't really have much to lose by paying far more than they currently do on bounties. Granted, eliminating what's largely a hypothetical edge case is not the primary benefit to paying higher; incentivizing far more white hat researchers is.
      - tptacek 10y ago
        Stealing this.
        dopamean 10y ago
        Me too. It really gets straight to the point.
    - colanderman 10y ago
      The problem with valuing bugs at their damage potential is that the total damage potential of all bugs in any given product is almost certainly magnitudes greater than the total value of the product itself.
  - peeters 10y ago
    Never mind the fact that it does matter to a lot of people whether they are committing a crime. Not everyone is a capitalist sociopath. If someone without a conscience wanted to maximize their profit, they'd probably just sell to both sides.
- sushid 10y ago
  People always say this but where would you go to find such a buyer? If you could find someone who would purchase it from you, would you process to then sell it to them? If you can't find a buyer and/or would most likely be unwilling to commit a crime, it's a moot point.

andkenneth 10y ago

Right, but this is facebook, and it's breaking auth. This is the company that said that if there's a million dollar bug, they will pay out for it. I'm not saying this is a million dollar bug, but breaking auth is up there on things that are bad and is probably worth a bit more than 5k.

stephengillie 10y ago

What if someone else was offering $10,000 for Facebook bugs, so they could exploit them? This bug could probably result in more than $5,000 in damages to the Facebook brand.

argonaut 10y ago
But someone isn't. That's the point. These bugs don't go for $10k on the black market.
- rl3 10y ago
  That's odd considering the potential monetary damage of such bugs can far exceed $10k.
  - XMPPwocky 10y ago
    One can smash a car up with a sledgehammer. Is the value of a sledgehammer equal to the value of a car?
    - deleted 10y ago
      [deleted]
    - rl3 10y ago
      >Is the value of a sledgehammer equal to the value of a car? My previous post was poorly worded; I didn't mean to imply equality. To use your analogy, valuing a serious vulnerability on a platform that has 1.65B users in the $5-10k range is tantamount to selling a 30lb sledge hammer for a dollar.
      - ponyfleisch 10y ago
        But what if producing a sledgehammer only cost 50 cents? Then people would sell sledgehammers for a dollar or less.
        rl3 10y ago
        Rather than torture this analogy further: Obviously exploit pricing is generally efficient and adheres to free market principles. That said, it's hypothetically possible that an exploit against a large tech company could sell for far more if the circumstances are right, considering the price to damage ratio is so skewed in addition to the unique nature of each exploit. Therefore, large tech companies don't really have much to lose by paying far more than they currently do on bounties. Granted, eliminating what's largely a hypothetical edge case is not the primary benefit to paying higher; incentivizing far more white hat researchers is.
    - tptacek 10y ago
      Stealing this.
      - dopamean 10y ago
        Me too. It really gets straight to the point.
  - colanderman 10y ago
    The problem with valuing bugs at their damage potential is that the total damage potential of all bugs in any given product is almost certainly magnitudes greater than the total value of the product itself.
- peeters 10y ago
  Never mind the fact that it does matter to a lot of people whether they are committing a crime. Not everyone is a capitalist sociopath. If someone without a conscience wanted to maximize their profit, they'd probably just sell to both sides.
sushid 10y ago
People always say this but where would you go to find such a buyer? If you could find someone who would purchase it from you, would you process to then sell it to them? If you can't find a buyer and/or would most likely be unwilling to commit a crime, it's a moot point.