3 ms·

Great blog post. The company response was really great, but there was no mention of a bug bounty. This would be a perfect example if he got paid for his finding

Great blog post. The company response was really great, but there was no mention of a bug bounty. This would be a perfect example if he got paid for his findings.

deleted 2y ago
[deleted]
ryan-c 2y ago
I'm not male and I use gender neutral pronouns. The bugs I find are usually just ones I stumble across, I don't go looking for them. Bug bounty programs generally aren't worth the trouble for me anyway - I have to file taxes in both the US and the UK so the paperwork gets really annoying.
- saulpw 2y ago
  I wanted to see your talk on Hacking Gender, but the link on your about page is broken, it seems to have been taken down :(
  - ryan-c 2y ago
    I've fixed the link.
  - ryan-c 2y ago
    The link had been to an unofficial upload. I guess the uploader took it down after EMF's official version was posted.
mjg59 2y ago
Adding to Ryan's concerns, submitting to a bug bounty program often means accepting terms and conditions that constrain your ability to publicly disclose the issue if the vendor decides to be a dick about it. Depending on how you think your career potentially benefits from freedom to discuss an issue, the long-term financial benefit is potentially greater from not going down the bug bounty path.
- ryan-c 2y ago
  Oh, yeah, I'd forgotten about the NDAs, those are a big NOPE for me.