5 ms·

I don't understand what Yahoo did wrong. They didn't have to pay a cent but they did. I understand that it is nominal, but it is better than nothing. I guess ju

by dkroy 13y ago

I don't understand what Yahoo did wrong. They didn't have to pay a cent but they did. I understand that it is nominal, but it is better than nothing. I guess just not in the case where the press can get a hold of it.

magicarp 13y ago
If they don't compensate security researchers enough, the incentive to find security holes goes away. People do this for a living.
- gradstudent 13y ago
  My understanding is that nobody hired these guys to do anything and no bounty was offered for anything. So why should there be any expectation for a financial reward?
  - jdiez17 13y ago
    Security researchers' time is valuable. They spend their own time trying to find vulnerabilities that black hat hackers would use against their users, possibly at a profit. They report it to the company giving them a chance to fix their problems. It's called responsible disclosure, and the compensation keeps the smart guys on your side. It doesn't even have to be monetary - for example, GitHub maintains a list[1] of people who have responsibly disclosed vulnerabilities, and they often send them a shirt or something similar. [1] https://help.github.com/articles/responsible-disclosure-of-security-vulnerabilities https://help.github.com/articles/responsible-disclosure-of-s...
    - tedunangst 13y ago
      This sounds remarkably like how the squeegee men operate in a big city. Oh, hey, I just washed your windshield, you owe me some money. No? Oops, terribly sorry about that scratch as I walked by.
      - Yen 13y ago
        Except the squeegee men offer a service that you don't really need, and doesn't offer you much value. Responsible disclosure to a company is often much more important than a clean windshield is to you.
    - gradstudent 13y ago
      > Security researchers' time is valuable. Maybe. But nobody asked these guys to do a thing. Ergo, no foul.
- zwp 13y ago
  On the flip side, HT Bridge have got way more than 12.50 USD publicity out of this.
  - cortesoft 13y ago
    This seems to be the entire point of the article - publicity for HT Bridge.
javert 13y ago
> it is better than nothing No, it's really not. Which is why it is so insulting. It would have been much better to just say "thanks" and give nothing.
pjbringer 13y ago
Putting a dollar amount on anything signals value perception. 12.50$ is a lot worse than a warm welcome, or other free rewards like public acknowledgement, because it says Yahoo really couldn't care less about finding such bugs.
- ijk 13y ago
  Known as the overjustification effect: http://en.wikipedia.org/wiki/Overjustification_effect http://en.wikipedia.org/wiki/Overjustification_effect
DerpDerpDerp 13y ago
> To add insult to injury, they can’t even order a burger with their bounty, which can only be spent at the Yahoo Company Store Yahoo gave them $25 in store credit at Yahoo. I'd rather have gotten a nice letter, because that kind of "compensation" is as much trying to attract business to Yahoo products as it is trying to reward me. In all likelihood, they'd have earned at least 10 times as much spending the same number of hours at Burger King, and probably over 100 times as much selling the flaws. Grossly underpaying is much more insulting, because it says directly what they value your work at, than not paying, which may simply be a policy of not handing out rewards for that kind of behavior.
- evan_ 13y ago
  What makes you think they didn't also get a nice letter?
  - DerpDerpDerp 13y ago
    By default, it can't be a 'nice' letter if it contains an insulting message - which is what's communicated by that level and type of reward. My point is Yahoo's message to the people would have been taken better as /just/ a letter, than a letter and a far undervalued "reward".
    - tedunangst 13y ago
      Perhaps the idea was to say "hey, thanks, here's a tshirt. Instead of us picking one, you go ahead and pick out any one you like." Or is a letter and a novelty gift also an insult?
      - deleted 13y ago
        [deleted]
      - DerpDerpDerp 13y ago
        Picking out a novelty gift would be fine, you could even have put some thought in to what it would be; acting like giving me the funds equivalent to a novelty gift is a reward tells me the precise dollar value you attached to my work, which is insulting. The funds are considerably more impersonal than simply giving a gift and demonstrate in a concrete way the low value it was given by Yahoo - not even worth a personal email to ask about tshirt size/style.

by dkroy 13y ago

magicarp 13y ago

If they don't compensate security researchers enough, the incentive to find security holes goes away. People do this for a living.

gradstudent 13y ago
My understanding is that nobody hired these guys to do anything and no bounty was offered for anything. So why should there be any expectation for a financial reward?
- jdiez17 13y ago
  Security researchers' time is valuable. They spend their own time trying to find vulnerabilities that black hat hackers would use against their users, possibly at a profit. They report it to the company giving them a chance to fix their problems. It's called responsible disclosure, and the compensation keeps the smart guys on your side. It doesn't even have to be monetary - for example, GitHub maintains a list[1] of people who have responsibly disclosed vulnerabilities, and they often send them a shirt or something similar. [1] https://help.github.com/articles/responsible-disclosure-of-security-vulnerabilities https://help.github.com/articles/responsible-disclosure-of-s...
  - tedunangst 13y ago
    This sounds remarkably like how the squeegee men operate in a big city. Oh, hey, I just washed your windshield, you owe me some money. No? Oops, terribly sorry about that scratch as I walked by.
    - Yen 13y ago
      Except the squeegee men offer a service that you don't really need, and doesn't offer you much value. Responsible disclosure to a company is often much more important than a clean windshield is to you.
  - gradstudent 13y ago
    > Security researchers' time is valuable. Maybe. But nobody asked these guys to do a thing. Ergo, no foul.
zwp 13y ago
On the flip side, HT Bridge have got way more than 12.50 USD publicity out of this.
- cortesoft 13y ago
  This seems to be the entire point of the article - publicity for HT Bridge.

javert 13y ago

> it is better than nothing No, it's really not. Which is why it is so insulting. It would have been much better to just say "thanks" and give nothing.

pjbringer 13y ago

Putting a dollar amount on anything signals value perception. 12.50$ is a lot worse than a warm welcome, or other free rewards like public acknowledgement, because it says Yahoo really couldn't care less about finding such bugs.

ijk 13y ago
Known as the overjustification effect: http://en.wikipedia.org/wiki/Overjustification_effect http://en.wikipedia.org/wiki/Overjustification_effect

DerpDerpDerp 13y ago

> To add insult to injury, they can’t even order a burger with their bounty, which can only be spent at the Yahoo Company Store Yahoo gave them $25 in store credit at Yahoo. I'd rather have gotten a nice letter, because that kind of "compensation" is as much trying to attract business to Yahoo products as it is trying to reward me. In all likelihood, they'd have earned at least 10 times as much spending the same number of hours at Burger King, and probably over 100 times as much selling the flaws. Grossly underpaying is much more insulting, because it says directly what they value your work at, than not paying, which may simply be a policy of not handing out rewards for that kind of behavior.

evan_ 13y ago
What makes you think they didn't also get a nice letter?
- DerpDerpDerp 13y ago
  By default, it can't be a 'nice' letter if it contains an insulting message - which is what's communicated by that level and type of reward. My point is Yahoo's message to the people would have been taken better as /just/ a letter, than a letter and a far undervalued "reward".
  - tedunangst 13y ago
    Perhaps the idea was to say "hey, thanks, here's a tshirt. Instead of us picking one, you go ahead and pick out any one you like." Or is a letter and a novelty gift also an insult?
    - deleted 13y ago
      [deleted]
    - DerpDerpDerp 13y ago
      Picking out a novelty gift would be fine, you could even have put some thought in to what it would be; acting like giving me the funds equivalent to a novelty gift is a reward tells me the precise dollar value you attached to my work, which is insulting. The funds are considerably more impersonal than simply giving a gift and demonstrate in a concrete way the low value it was given by Yahoo - not even worth a personal email to ask about tshirt size/style.