3 ms·
Fifteen thousand dollars to report a bug in a PAM module that you need a local account to exploit? That is excessive. I don't think a professional would get pai
by peterwwillis 10y ago
Fifteen thousand dollars to report a bug in a PAM module that you need a local account to exploit? That is excessive. I don't think a professional would get paid that much for an audit of the project (and they didn't hire one, this just one bug report)
- tptacek 10y ago$15k sounds about on the money for the consulting project to assess pam-ussh. But I agree that it's a silly amount for a bounty.
- eric_the_read 10y agoThe actual bounty was $1,500, not $15,000: https://hackerone.com/reports/204802#activity-1513764 https://hackerone.com/reports/204802#activity-1513764
- peterwwillis 10y agoYes. The parent-parent said "It seems to me another zero on the end would be appropriate. "
- eric_the_read 10y agoPerhaps one day I'll learn to read. Sorry 'bout that.