4 ms·

$7500 seems low for this bug. If I were Facebook i would raise it. Why? Cost/benefit analysis tells me I could probably get a lot more for this bug going to so

by anonu 6y ago

$7500 seems low for this bug. If I were Facebook i would raise it. Why? Cost/benefit analysis tells me I could probably get a lot more for this bug going to some more nefarious actors. $7500 is a drop in the ocean for a company like FB who has a reputation to keep intact.

zitterbewegung 6y ago
How do you know if this is happening or not?
underwater 6y ago
If you're OK commiting blatantly illegal acts for money you could just go rob a bank, too.
- LockAndLol 6y ago
  Can someone name this fallacy for me? It sounds like the slippery slope fallacy, but I'm not sure.
  - underwater 6y ago
    Maybe you're thinking false equivalence? What I'm pointing out that just because you can make a lot of money by doing something illegally doesn't mean you should expect to similar amounts of money using those skills in a legal way. Walter White would back me up on this.
  - kart23 6y ago
    Its a strawman.
- ss2003 6y ago
  Lots of places you could do this from where it would not be illegal.
- TameAntelope 6y ago
  It’s at least marginally harder to get shot sitting at my laptop in my room...
detaro 6y ago
You happen to know some more nefarious actors?
baby 6y ago
I always see posts like this, but I’m wondering at what amount of money would people feel like it’s fair?
- xtracto 6y ago
  Imho it would be fair if it was treated on a cost per hour basis. So a typical sec researcher will charge $350 per hour. So if this hack took 10 hours then $3500 would be fair
  - justusthane 6y ago
    I’m not a security researcher but I disagree with this rationale on a number of levels. First, just intuitively it feels wrong. It’s like saying that if you need a $20 permit for camping, but if you get caught camping illegally the fine should only be as much as the permit. Clearly it should be more. More specific issues: - Who determines how long the hack took? - A security researcher is guaranteed the $350/hour whether or not they find the exploit. The bug hunter only gets paid if they find an exploit. Thus, if you follow this out logically every bug hunter should really just be a contracted security researcher and the only bugs being uncovered would be the ones companies were paying upfront to find. In other words, freelance bug hunting is deincentivized.
Barrin92 6y ago
I mean evidently enough people go to Facebook for them not seeing the need to raise the price on bug reports, or else they'd probably do just that. The barrier for most people to sell data to criminals is high, both because it's illegal and because most people have at least enough of an ethical compass to not sell their services to scammers.

by anonu 6y ago

zitterbewegung 6y ago

How do you know if this is happening or not?

underwater 6y ago

If you're OK commiting blatantly illegal acts for money you could just go rob a bank, too.

LockAndLol 6y ago
Can someone name this fallacy for me? It sounds like the slippery slope fallacy, but I'm not sure.
- underwater 6y ago
  Maybe you're thinking false equivalence? What I'm pointing out that just because you can make a lot of money by doing something illegally doesn't mean you should expect to similar amounts of money using those skills in a legal way. Walter White would back me up on this.
- kart23 6y ago
  Its a strawman.
ss2003 6y ago
Lots of places you could do this from where it would not be illegal.
TameAntelope 6y ago
It’s at least marginally harder to get shot sitting at my laptop in my room...

detaro 6y ago

You happen to know some more nefarious actors?

baby 6y ago

I always see posts like this, but I’m wondering at what amount of money would people feel like it’s fair?

xtracto 6y ago
Imho it would be fair if it was treated on a cost per hour basis. So a typical sec researcher will charge $350 per hour. So if this hack took 10 hours then $3500 would be fair
- justusthane 6y ago
  I’m not a security researcher but I disagree with this rationale on a number of levels. First, just intuitively it feels wrong. It’s like saying that if you need a $20 permit for camping, but if you get caught camping illegally the fine should only be as much as the permit. Clearly it should be more. More specific issues: - Who determines how long the hack took? - A security researcher is guaranteed the $350/hour whether or not they find the exploit. The bug hunter only gets paid if they find an exploit. Thus, if you follow this out logically every bug hunter should really just be a contracted security researcher and the only bugs being uncovered would be the ones companies were paying upfront to find. In other words, freelance bug hunting is deincentivized.

Barrin92 6y ago

I mean evidently enough people go to Facebook for them not seeing the need to raise the price on bug reports, or else they'd probably do just that. The barrier for most people to sell data to criminals is high, both because it's illegal and because most people have at least enough of an ethical compass to not sell their services to scammers.