3 ms·

Feels just a little entitled. For the longest time hackers would notice an issue on a service they used, and out of respect for the service and concern for thei

Feels just a little entitled. For the longest time hackers would notice an issue on a service they used, and out of respect for the service and concern for their own data, they would report. Threats of legal action would quickly follow, so hackers stopped reporting. Now a lot of the major players have policies promising no legal action for responsible disclosure, some even have rewards (whether monetary or acknowledgement) for the hackers. In this case, a response was given, no legal action was threatened, and the bug was quickly fixed. Isn't this the goal? Looks like Yahoo is doing their job here.

btipling 13y ago
It's not self-entitlement, the OP is not obligated to help Yahoo! and simply states that there will be no more work for free. It's in Yahoo!'s incentive to provide whitehats incentive, because people with malicious intent already have incentive and Yahoo! should want legitimate security research types to find vulnerabilities before attackers do.
ISL 13y ago
Well, it sounds like the author feels entitled to a 'thank you'. Trouble is, it's not necessarily in the company's interest to acknowledge a past vulnerability in writing. Security team could've called him though; no paper trail, and it would've felt very authentic and personal.
reaclmbs 13y ago
If anyone had the same allergic reaction I did to the above comment, please get in touch.
quackerhacker 13y ago
Acknowledgement, I agree, is required at least. The OP got that from a bot. Monetary is always nice, but reputation...or just an ACTUAL person on the dev team saying "thank you for your help," is better than NOTHING as assumed in this article.
- bluesmoon 13y ago
  actually that wasn't a bot. the volume of security reports is too low to require an automated task. that mail was probably sent out by someone from the security team. It is a form letter, but that's for consistency across responses.

btipling 13y ago

It's not self-entitlement, the OP is not obligated to help Yahoo! and simply states that there will be no more work for free. It's in Yahoo!'s incentive to provide whitehats incentive, because people with malicious intent already have incentive and Yahoo! should want legitimate security research types to find vulnerabilities before attackers do.

ISL 13y ago

Well, it sounds like the author feels entitled to a 'thank you'. Trouble is, it's not necessarily in the company's interest to acknowledge a past vulnerability in writing. Security team could've called him though; no paper trail, and it would've felt very authentic and personal.

reaclmbs 13y ago

If anyone had the same allergic reaction I did to the above comment, please get in touch.

quackerhacker 13y ago

Acknowledgement, I agree, is required at least. The OP got that from a bot. Monetary is always nice, but reputation...or just an ACTUAL person on the dev team saying "thank you for your help," is better than NOTHING as assumed in this article.

bluesmoon 13y ago
actually that wasn't a bot. the volume of security reports is too low to require an automated task. that mail was probably sent out by someone from the security team. It is a form letter, but that's for consistency across responses.