5 ms·
wait, how much money did he pay out to whom? what would be the point of not listing who is being paid nor what they're being paid except for deception?
by trotsky 14y ago
wait, how much money did he pay out to whom? what would be the point of not listing who is being paid nor what they're being paid except for deception?
- redthrowaway 14y agoWell, there's the one email where they've offered 1000 EUR ($1336.20 at today's rates) for an XSS bug. It seems they've been following up on it, and you'll certainly hear about it if they don't.
- DoubleCluster 14y agoI really hope they'd add $0.80 when paying out in dollars.
- DigitalSea 14y agoDoes it matter how much money he paid out and to who? Things are getting fixed by the looks of it. Do Google or Facebook release a list of names and how much they paid for their bounty programs? (I did a search, but couldn't find anything, so maybe they do). If Dotcom were to try and rip someone off, sites like Techcrunch would foam at the mouth to release a story like that. Everyone loves to hate Dotcom, the insinuation in your comment about deception proves this very fact (unless you have evidence that proves he is being deceptive and hiding the information for nefarious reasons?).
- pyre 14y agoThe people that would blow the whistle on this are people that report bugs, but don't get paid. If he claims to have paid people, but the 'people' and vulnerabilities are just fabrications, then only someone within the organization would be able to blow the whistle, no?
- bbatsell 14y ago> Do Google or Facebook release a list of names and how much they paid for their bounty programs? Names, yes; $, no. [1]: https://www.google.com/about/appsecurity/hall-of-fame/reward/ https://www.google.com/about/appsecurity/hall-of-fame/reward... [2]: https://www.facebook.com/whitehat/ https://www.facebook.com/whitehat/
- shared4you 14y ago$, yes. One of the Indians who was gifted by google: http://www.sandeepkamble.com/skl337/2012/12/28/vulnerability-report-activities-gift/ http://www.sandeepkamble.com/skl337/2012/12/28/vulnerability...
- MojoJolo 14y agoFacebook is giving a $500 minimum reward. https://www.facebook.com/whitehat/bounty/ https://www.facebook.com/whitehat/bounty/
- nilsjuenemann 14y agoHere some facts and numbers about Google's VRP: http://www.nilsjuenemann.de/2012/12/news-about-googles-vulnerability-reward.html http://www.nilsjuenemann.de/2012/12/news-about-googles-vulne...
- trotsky 14y agoyes, amounts and names/handles are listed by google and mozilla - not sure about facebook. To be clear - you think it's fine to cite the announcement of an undisclosed amount of money being paid to an undisclosed list of people as proof of their status as a good actor, yet you require concrete evidence that they are being deceptive for nefarious reasons to question his motives.
- phaus 14y agoResponsible disclosure includes protecting the privacy of everyone involved. If the people who have been awarded bounties want the publicity, I'm sure they will let us know who they are.
- trotsky 14y agohttp://www.chromium.org/Home/chromium-security/hall-of-fame http://www.chromium.org/Home/chromium-security/hall-of-fame google == irresponsible ?
- kefs 14y agoname disclosure is optional, not mandatory.. http://www.chromium.org/Home/chromium-security/vulnerability-rewards-program#TOC-Can-you-keep-my-identity-confidential-from-the-rest-of-the-world- http://www.chromium.org/Home/chromium-security/vulnerability...
- phaus 14y agoAs already stated, Google's hall-of-fame is voluntary. If you conduct any sort of business transaction with someone (and that's exactly what this is) a good business would assume that the transaction is private unless other arrangements are made with the other party. It's common sense and common courtesy. If Mr. Dotcom asked first and then publicized the names, that's fine. If he made it a requirement of collecting the bounty, he's also within his rights. However, if he gave them the money and then disclosed their identities without asking them, it's would be an unprofessional thing to do. Not unforgivable, just unprofessional. Some people value privacy and anonymity. That's their prerogative.