4 ms·
Not to mention his extremely well founded comments on their patch. High level consulting basically.
by lima 10y ago
Not to mention his extremely well founded comments on their patch.
High level consulting basically.
- peterwwillis 10y agoFifteen thousand dollars to report a bug in a PAM module that you need a local account to exploit? That is excessive. I don't think a professional would get paid that much for an audit of the project (and they didn't hire one, this just one bug report)
- tptacek 10y ago$15k sounds about on the money for the consulting project to assess pam-ussh. But I agree that it's a silly amount for a bounty.
- eric_the_read 10y agoThe actual bounty was $1,500, not $15,000: https://hackerone.com/reports/204802#activity-1513764 https://hackerone.com/reports/204802#activity-1513764
- peterwwillis 10y agoYes. The parent-parent said "It seems to me another zero on the end would be appropriate. "
- eric_the_read 10y agoPerhaps one day I'll learn to read. Sorry 'bout that.
- ble 10y agoThe public release of the report (where the bounty hunter talks extensively about the right and wrong ways to fix the issue) is a nice feather to put in your cap, even if the cash is not a lot.
- breakingcups 10y agoAh, the old "do-it-for-the-publicity" :)