9 ms·

The Federal Labor Standards Act has provisions about anyone under the age of 18 working for companies whose revenue is greater than $500,000. It sucks to be a

The Federal Labor Standards Act has provisions about anyone under the age of 18 working for companies whose revenue is greater than $500,000. It sucks to be a kid for a lot of reasons. This kid just blamed Paypal for one of our country's many idiotic federal laws. This choice should be considered a career limiting decision by any hiring manager.

ancarda 13y ago
Couldn't they just pay him once he turns 18? Or at the least reward him in some other way.
- lambda 13y ago
  Or, pay him via his parents. Somehow we manage to have child actors get paid by movie studios; there must be a way for them to be able to pay children bug bounties, if they actually wanted to.
  - daurnimator 13y ago
    Child actor are specifically excluded from many labor laws; they also have a whole different set of special laws just for them. (Obviously this is country/state specific)
cperciva 13y ago
This choice should be considered a career limiting decision by any hiring manager. Are you saying that you're holding a 17 year old student in Germany responsible for not understanding US labor laws?
- deleted 13y ago
  [deleted]
- skeletonjelly 13y ago
  I find the meaning and knowledge of laws to be inaccessible overall as a 18+ citizen. I'm not American, but who for instance knew that there were "provisions" under the Federal Labor Standards Act?
- twistedpair 13y ago
  It makes me angry, but the law here in the US is that "ignorance is not a defense." Oh... you didn't know our several million laws when you broke one? Too bad, they say. Lawyers counter that if the law was simpler, they wouldn't have jobs.
  - cperciva 13y ago
    Yes, but US labor laws don't apply to someone living in Germany anyway.
  - tokenizerrr 13y ago
    Ok. Now if only the kid actually was over there in the US.
    - criley 13y ago
      It's not that simple. When you access an American network, your usage is governed my American laws -- period. You make it sound like if you hacked into Paypal from Germany you'd be completely immune to American law on the matter because you're not in the US. That's simply not true.
- deleted 13y ago
  [deleted]
polemic 13y ago
They didn't have to pay him. Still very poorly handled. Should've gone something like: 1. "Hey, that's awesome that you found that, thanks!" 2. "For very good reasons (a), (b) and (c) we can't actually pay you, that really sucks :(" 3. "But hey we like your style, so how about we fly you over for an internship when you've finished school / investigate if Germany has different rules / look at scholorship options and a great reference / [one of a million other things you could do to help a kid out"
- C1D 13y ago
  I totally agree, and they have the ability to give him the money. All they would have to do is ask for a parent to represent him.
  - rgbrenner 13y ago
    IANAL.. but I can't see how asking a parent to represent him would relieve PayPal of complying with labor standards for minors... he's still the one doing the work.. and advising him to have a parent represent him is just written proof that they knew.
- ireadqrcodes 13y ago
  internship for $300k / year would be appropriate
Karunamon 13y ago
Wait, it's considered "working for" when there's no employment relationship of any kind?
- shmerl 13y ago
  Yeah, that's what puzzled me as well.
- AaronI 13y ago
  I doubt it has to do with labor laws, specifically. Payment is paid through a verified Paypal account, which you must be 18 years of age to use their services according to their user agreement.
  - icebraining 13y ago
    I'm pretty sure he could have found some adult to receive the money for him, if it had been offered as a possibility.
  - TomGullen 13y ago
    Can't they just post him a cheque?
shmerl 13y ago
Can they frame the bounty not as a payment? But like some kind of prize etc.
georgemcbay 13y ago
"This choice should be considered a career limiting decision by any hiring manager." Hopefully not forever. When I was young and stupid and the net was a much simpler place I casually fully disclosed the problem with posting your Cisco configs with "encrypted" passwords to Usenet: https://groups.google.com/d/msg/comp.dcom.sys.cisco/WjuKAOQLfkI/HKJ18Osl7z4J https://groups.google.com/d/msg/comp.dcom.sys.cisco/WjuKAOQL... I would not do something like this today, especially not in such a full-of-myself douchey manner. Sadly a lot of postings to the internet are basically "forever" at this point and combined with the insistence of so many companies that real names be used, we're going to have generations of younger folks who say or do something stupid (because they are young and stupid) that they can never get rid of. And that's unfortunate.
- droopybuns 13y ago
  "Hopefully not forever." I completely agree. I also think that this kind of post on full-disclosure should be used as an example of what-not-to-do. I've always treated vuln reward programs as resume enhancers. If you submit a bug and get it fixed, you get to show two incredibly valuable and rare skills in the infosec community: 1) technical chops 2) interpersonal skill Disclosers who have the patience to endure some of the bullshit that comes up in these programs are going to be successful in the security industry. The hardest problems in infosec are not technical. They are cultural. Publicly flaming a vuln reward program because they didn't pay you for what you see as an arbitrary reason is exactly the kind of reason execs do not want to do vuln reward programs. Someone had to fight to get that program set up at paypal. It had to be within the laws of the country that governs the company. This kid just through a temper tantrum in public and signed his name on the email. Any advocates he had at paypal are probably re-evaluating their support of him. So short sighted.
- erock 13y ago
  just an FYI, you can (even if you don't have the email anymore) get old posts removed from google groups, you have to jump through a bunch of hoops, but it isn't too hard to do. Just read around. I had to cover for 18 year old me posting god knows what on usenets several years ago. I did this when google first bought deja news however, you can likely get them to remove it. who knew people were saving stuff back in 94-95. hell anyway 18 year old me didn't care, but luckily I can cover for him.
nknighthb 13y ago
The Fair Labor Standards Act places no limitations on the work of 16 and 17 year olds in non-hazardous jobs, and in any case does not concern itself with non-employment relationships like the one Paypal would have had with this 17-year-old. There is a reason that you read about minors running their own businesses all the time. The laws are targeted at employment that is exploitative or interferes with a child's education. Not at things like this.
deleted 13y ago
[deleted]
oijaf888 13y ago
How do those apply in Germany? Do all subsidiaries in all countries have to follow FLSA? I assume Paypal's German subsidiary is only responsible for following German employment law.
SamReidHughes 13y ago
You should try not coming up with bad reasons to not hire qualified candidates.

ancarda 13y ago

Couldn't they just pay him once he turns 18? Or at the least reward him in some other way.

lambda 13y ago
Or, pay him via his parents. Somehow we manage to have child actors get paid by movie studios; there must be a way for them to be able to pay children bug bounties, if they actually wanted to.
- daurnimator 13y ago
  Child actor are specifically excluded from many labor laws; they also have a whole different set of special laws just for them. (Obviously this is country/state specific)

cperciva 13y ago

This choice should be considered a career limiting decision by any hiring manager. Are you saying that you're holding a 17 year old student in Germany responsible for not understanding US labor laws?

deleted 13y ago
[deleted]
skeletonjelly 13y ago
I find the meaning and knowledge of laws to be inaccessible overall as a 18+ citizen. I'm not American, but who for instance knew that there were "provisions" under the Federal Labor Standards Act?
twistedpair 13y ago
It makes me angry, but the law here in the US is that "ignorance is not a defense." Oh... you didn't know our several million laws when you broke one? Too bad, they say. Lawyers counter that if the law was simpler, they wouldn't have jobs.
- cperciva 13y ago
  Yes, but US labor laws don't apply to someone living in Germany anyway.
- tokenizerrr 13y ago
  Ok. Now if only the kid actually was over there in the US.
  - criley 13y ago
    It's not that simple. When you access an American network, your usage is governed my American laws -- period. You make it sound like if you hacked into Paypal from Germany you'd be completely immune to American law on the matter because you're not in the US. That's simply not true.
deleted 13y ago
[deleted]

polemic 13y ago

They didn't have to pay him. Still very poorly handled. Should've gone something like: 1. "Hey, that's awesome that you found that, thanks!" 2. "For very good reasons (a), (b) and (c) we can't actually pay you, that really sucks :(" 3. "But hey we like your style, so how about we fly you over for an internship when you've finished school / investigate if Germany has different rules / look at scholorship options and a great reference / [one of a million other things you could do to help a kid out"

C1D 13y ago
I totally agree, and they have the ability to give him the money. All they would have to do is ask for a parent to represent him.
- rgbrenner 13y ago
  IANAL.. but I can't see how asking a parent to represent him would relieve PayPal of complying with labor standards for minors... he's still the one doing the work.. and advising him to have a parent represent him is just written proof that they knew.
ireadqrcodes 13y ago
internship for $300k / year would be appropriate

Karunamon 13y ago

Wait, it's considered "working for" when there's no employment relationship of any kind?

shmerl 13y ago
Yeah, that's what puzzled me as well.
AaronI 13y ago
I doubt it has to do with labor laws, specifically. Payment is paid through a verified Paypal account, which you must be 18 years of age to use their services according to their user agreement.
- icebraining 13y ago
  I'm pretty sure he could have found some adult to receive the money for him, if it had been offered as a possibility.
- TomGullen 13y ago
  Can't they just post him a cheque?

shmerl 13y ago

Can they frame the bounty not as a payment? But like some kind of prize etc.

georgemcbay 13y ago

"This choice should be considered a career limiting decision by any hiring manager." Hopefully not forever. When I was young and stupid and the net was a much simpler place I casually fully disclosed the problem with posting your Cisco configs with "encrypted" passwords to Usenet: https://groups.google.com/d/msg/comp.dcom.sys.cisco/WjuKAOQLfkI/HKJ18Osl7z4J https://groups.google.com/d/msg/comp.dcom.sys.cisco/WjuKAOQL... I would not do something like this today, especially not in such a full-of-myself douchey manner. Sadly a lot of postings to the internet are basically "forever" at this point and combined with the insistence of so many companies that real names be used, we're going to have generations of younger folks who say or do something stupid (because they are young and stupid) that they can never get rid of. And that's unfortunate.

droopybuns 13y ago
"Hopefully not forever." I completely agree. I also think that this kind of post on full-disclosure should be used as an example of what-not-to-do. I've always treated vuln reward programs as resume enhancers. If you submit a bug and get it fixed, you get to show two incredibly valuable and rare skills in the infosec community: 1) technical chops 2) interpersonal skill Disclosers who have the patience to endure some of the bullshit that comes up in these programs are going to be successful in the security industry. The hardest problems in infosec are not technical. They are cultural. Publicly flaming a vuln reward program because they didn't pay you for what you see as an arbitrary reason is exactly the kind of reason execs do not want to do vuln reward programs. Someone had to fight to get that program set up at paypal. It had to be within the laws of the country that governs the company. This kid just through a temper tantrum in public and signed his name on the email. Any advocates he had at paypal are probably re-evaluating their support of him. So short sighted.
erock 13y ago
just an FYI, you can (even if you don't have the email anymore) get old posts removed from google groups, you have to jump through a bunch of hoops, but it isn't too hard to do. Just read around. I had to cover for 18 year old me posting god knows what on usenets several years ago. I did this when google first bought deja news however, you can likely get them to remove it. who knew people were saving stuff back in 94-95. hell anyway 18 year old me didn't care, but luckily I can cover for him.

nknighthb 13y ago

The Fair Labor Standards Act places no limitations on the work of 16 and 17 year olds in non-hazardous jobs, and in any case does not concern itself with non-employment relationships like the one Paypal would have had with this 17-year-old. There is a reason that you read about minors running their own businesses all the time. The laws are targeted at employment that is exploitative or interferes with a child's education. Not at things like this.

deleted 13y ago

[deleted]

oijaf888 13y ago

How do those apply in Germany? Do all subsidiaries in all countries have to follow FLSA? I assume Paypal's German subsidiary is only responsible for following German employment law.

SamReidHughes 13y ago

You should try not coming up with bad reasons to not hire qualified candidates.