3 ms·

Companies' bug bounty programs are bound by their terms of service, not by this policy or the CFAA so I'm not sure what you are complaining about. Additionally

by bragr 4y ago

Companies' bug bounty programs are bound by their terms of service, not by this policy or the CFAA so I'm not sure what you are complaining about. Additionally companies are under no obligation to pay anyone for security research they did on their own (which is not to say that's a good policy) but they don't have to, and attempting to extort them into paying was crime before and it's still a crime. The main people I would say this impacts is the people doing security research as a pure research pursuit, a hobby, otherwise as journalism or in the public interest.

1970-01-01 4y ago
Having a bug bounty system designed to maximize the work put into testing a system with minimum payout is my chief complaint. The new "policy" does nothing to help that.
- KerrAvon 4y ago
  No one is being compelled to do the work. Are you really saying you want the government involved in setting rates?
  - 1970-01-01 4y ago
    Rates would be going too far. I would like to see an exception for non-payment for services rendered.
    - bragr 4y ago
      You seem to confusing criminal federal law concerning unauthorized computer access with a civil federal law regulating the trade of software vulnerabilities, which is what you'd need to solve the "problem" you are complaining about.
      - tptacek 4y ago
        Which civil federal laws are those?