3 ms·
It's ridiculous EA didn't pay any bounty for this
by Fokamul 2y ago
It's ridiculous EA didn't pay any bounty for this
- qmarchi 2y agoBattleDash - "Here's XSS, Account Takeover, Ban Reversal, and a heads up before I publish it" EA - "So here's $0." If anyone is at EA, this man just saved the integrity of your entire empire, you might want to give him at least a token amount.
- londons_explore 2y agoMy experience with big companies is even if the whole IT security team thinks this is worthy of a bounty, and the team has plenty of budget they could allocate to it, the process of giving money to an individual is frequently so difficult to get through the bureaucratic purchase order system that it's basically impossible to do unless you are contractually obliged to pay.
- nijave 2y agoProbably easier to hire them on as a consultant than "give them money"
- JohnFen 2y agoEA is a famously horrible company. I don't think they care much about the "integrity of their empire" because their customers don't care.
- foobranded 2y agoWhen I was in college, I once found some bad exploits in the sims social on Facebook, the subsidiary (Playfish?) behind it asked me for my address and which console I owned and then unexpectedly sent me a huge number of games and goodies. It was great. Better than money, I think (I sold some of those games anyway). I reached out to employees via unofficial channels. I'm sure if I had spoken to some exec I'd be in jail right now.
- Perz1val 2y agoWould it be legal to publish any future vulnerabilities without giving them heads up?
- deleted 2y ago[deleted]
- boomchinolo78 2y agoUntil we see something like this, The company is liable for $10 per hacked user minus 100X the bounty spend for that year.