4 ms·
One day you walk outside and you notice your neighbor left his keys on top of his car. You knock on his door and let him know, he says "wow thanks for the head
by hsod 13y ago
One day you walk outside and you notice your neighbor left his keys on top of his car.
You knock on his door and let him know, he says "wow thanks for the heads up, I'll buy you a beer sometime"
You think to yourself, "A beer?? I just saved his car from being stolen-- that's worth a lot more than a beer"
A week later you walk outside and see he did it again. Instead of knocking on his door, you walk into the alley and tell a local criminal about it in exchange for 500 dollars.
This is essentially what you're advocating.
- eric_the_read 13y agoMore like you get a nickel, and next time, you think, "what a cheapskate", and don't bother mentioning it. After you walk by, a car thief steals it.
- invalidOrTaken 13y agoThe difference is that noticing it is much harder than "walking outside one day," and he's not just some homeowner. Rather, it's a bank, and through your advanced knowledge of structural engineering, and at least several days of work, you find a weak point in the wall that would allow for easy, noiseless drilling, allowing their vault to be emptied in ten minutes. I agree completely that Yahoo doesn't owe them a penny, and it would be reprehensible to find a "different market," as the grandparent alludes to. But it's not quite the same.
- icebraining 13y agoI don't see any advocating; it's more a statement of fact.
- amalag 13y agoUnless you had a full time job looking for your neighbors keys.
- jessaustin 13y agoThis is essentially what you're advocating. You have constructed an analogy so inapt that it threatens to suck all other dumb, unenlightening analogies on HN over its event horizon until it forms a sort of inapt hole from which dumb analogies could never escape. Which would be a good thing, so good job!
- Yen 13y agoI don't know if OP is advocating it, per se, but those marketplaces do exist. Even though it's morally and legally wrong, there is an incentive to sell exploits to the bad guys, instead of disclosing them to the company. The analogy is a bit off, as 'a beer' is relatively good compensation for the disclosure of the car-key vulnerability, compared to the potential black-market value, and the potential loss to the owner. With this example, it's more like you told your neighbor about his forgotten keys, and they gave you a nickle and a pat on the head.
- DerpDerpDerp 13y agoA beer for the 3 minutes that you take to notice the key and tell him is about $120/hr. By contrast, assuming the vulnerability in Yahoo's system took just one work week, their offer was $0.31/hr. That's 384 times worse than your neighbor giving you a beer for finding his key. This is why your neighbor gets his key back for a beer and people are recommending black marketing Yahoo's vulnerabilities.