6 ms·

$4.5k for spec work isn't that bad. They could've paid $0. With that said, I keep my facebook account only for testing applications.

• amirmc 13y ago
  But perhaps now there's a signalling problem. If you find an exploit of a similar nature you can expect a mid-four figure sum from FB. Now if you're feeling less than white-hatty you can wonder how much more you can get elsewhere. It's easy to say that FB could have paid $0 but if people knew that, it would make "responsible disclosure" even less likely to happen.
  • readme 13y ago
    "Responsible disclosure" shouldn't be up to a financial incentive. It's up to the law and basic ethics. The real choice is between a 4.5k bonus or a subpoena. If you want to try the other path, go ahead....
    • crazypyro 13y ago
      Actually its a legal gray area. The prosecution would have to prove that you knew that you were selling to known criminals. This means you would have to sell to someone that literally told you what they are going to use it for.
      • readme 13y ago
        Interesting. I think we can agree the alternative is the wrong choice, though. Shouldn't have assumed the law was sound in this area... Given that it's not usually sound in any..