3 ms·
I agree he deserves a higher payout, but it was on a segmented server that seems like it didn't have any customer data or other important data. If he were a rea
by meowface 8y ago
I agree he deserves a higher payout, but it was on a segmented server that seems like it didn't have any customer data or other important data. If he were a real attacker, who knows where else he could've pivoted from this server (perhaps it wasn't quite as segmented as Facebook thought). But assuming it truly was pretty isolated, compromising it probably wouldn't have caused any damage.
Regardless, I feel like he deserves at least $15,000 for this, since it is full RCE.
- tptacek 8y agoWhere are you pulling that number out of?
- meowface 8y agoHonestly, just a gut feeling. (So, my ass.) I just feel like RCE should warrant somewhere around that much by default, even if the overall impact isn't high in a particular case. Some combination of potential impact and nature of the vulnerability/exposure should go into reward calculations, in my opinion.
- tedunangst 8y agoBut is RCE worth 15 because he got 5? If he'd gotten 1, would you say he deserved 5? Or 3?
- meowface 8y agoI think I would've said something close to $15k either way. $5k isn't insulting (in my opinion) given the context. $1k would definitely be insulting.
- arcticfox 8y agoProbably the same rather random place where $5000 got pulled out of in the first place