4 ms·
"I reported the fixation issue privately only because I'm a good guy and was in a good mood." I for one am glad that Homakov decided to share and write about t
by niggler 14y ago
"I reported the fixation issue privately only because I'm a good guy and was in a good mood."
I for one am glad that Homakov decided to share and write about these security issues rather than just selling it to the highest bidder. I have learned quite a bit over the past year. And it's deplorable that Github isn't paying anything.
- boundlessdreamz 14y agoHe was referring to companies which offer bounties (facebook, google etc) and not sites where you can sell your exploits
- homakov 14y agoyeah. i don't sell exploits yet. Facebook, stripe, shopify, skrill - they treat a reporter nicely.
- vecinu 14y agoAny reason why you would even consider selling exploits? Do you not get compensated well from other ventures?
- homakov 14y agoI can only buy some beer and snacks for this compensation
- homakov 14y agoJUST WONDER, how much would someone pay for this vuln? We can discuss it... homakov@gmail.com
- masklinn 14y ago> Do you not get compensated well from other ventures? He can likely get compensated much, much better for an original 0day on a big site.
- michaelt 14y agoIn negotiation theory your 'BATNA' or 'Best Alternative To Negotiated Agreement' is the second choice you'll go with if the current negotiation breaks down. Theoretically, neither party in a negotiation need accept less than their BATNA. For example, when you negotiate your annual raise, your best alternative is the raise you could get by moving to another employer (adjusted for benefits, time spent commuting, how fun the job is etc). You don't have to explicitly say to your boss "give me a raise or I'll quit" - your boss just needs to know your options are open. If homakov publicly says he'd never consider selling an exploit, he's saying his BATNA is $0 and some kudos on Hacker News. If he says he's undecided, his BATNA would be somewhere between a few thousand and a few hundred thousand dollars. Needless to say, the former statement closes off a lot of negotiation options while the latter leaves them open. [0] http://www.forbes.com/sites/andygreenberg/2012/03/23/shopping-for-zero-days-an-price-list-for-hackers-secret-software-exploits/ http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin...
- Oompa 14y agoJust because a bounty policy isn't disclosed doesn't mean it doesn't exist.
- homakov 14y agotrust me, it doesn't exist.
- charliesome 14y agoI've reported several vulnerabilities to GitHub. There is no bounty policy.
- homakov 14y agoyeah +1. @joernchen also did I remember. And lots of other people. Hey, anyone, is github that super profitable company with 100mln investments ? They got no money or what?
- beaumartinez 14y agoI guess people disclose enough vulns voluntarily that they don't need to offer a bounty as an incentive.
- homakov 14y ago= cheating
- mofle 14y agoI got a t-shirt some time back for reporting a serious XSS vulnerability.
- homakov 14y agothey like you.