12 ms·

So I’m the guy who sent the t-shirt out as a thank you

359 points by jnazario 13y ago

bhuga 13y ago
A classy, concrete response in a human voice. This is exactly how great companies communicate. Putting together a bug bounty program for a company like Yahoo is a lot of hard work with tons of tiny gotchas. It can take forever, and it's never ready when it needs to be. Looking forward to it.
jnazario 13y ago
note: ramses is a friend. so while i can't speak for him, what i can say is that i've known him for many years, worked closely with him on very large, global issues, and have found him to be a very standup, forthright guy who strives to make the world a better place.
- sjtgraham 13y ago
  It's very nice that he bought t-shirts at his own personal expense. He comes over as such a conscientious person that I feel bad "t-shirt-gate" happened.
santosha 13y ago
Good on them.
post_break 13y ago
Seems like too little too late. The tshirt thing might have been in good faith, but wow was it a slap in the face. I wouldn't be surprised if exploits were sold for less than what they could fetch from Yahoo as a sort of candid rebellion. I'd love to see someone find an exploit, and then send Yahoo a shirt.
- jevinskie 13y ago
  What else do you want them to do? They are even making the new policy retroactive back to July.
- alanctgardner2 13y ago
  A slap in the face? I know bug bounty programs are a very good idea, no arguments. If a company doesn't have a formally posted bug bounty, though, I wouldn't be looking for vulnerabilities for money. Approaching a company with no formal structure in place to assess or pay out bounties, and saying 'you owe me a bunch of money' is never going to be a winning proposition. I think what this guy was doing was awesome; he clearly understands the value of the work researchers were doing, and he did what was in his power to thank them. Compared to getting no reaction, or a terse email, this is probably in the top 20% of responses to random vulnerability disclosures.
- elliottcarlson 13y ago
  This is self-entitled bullshit. If you (not you, but people in general) want to make a living off of reporting bugs, then get a job in the field, or know which companies are explicitly paying bounties. How is that expectation of a reward anything more than blackmail?
  - post_break 13y ago
    You're coming at this all wrong. Take a step back and think about the users. Imagine your a Yahoo user and you learn that a hacker finds an exploit to take over accounts and tries to submit it to the company. They in tern send him a tshirt a friendly smile and a handshake. What does that tell you about the company? Does that make you feel like your account, data, etc is secure and more exploits will just be handed over? It's not about the money, it's about sending a message. And instead of chaos and people wearing masks, we've got vulnerabilities, and the idea the Yahoo actually values its users.
  - deleted 13y ago
    [deleted]
- wheelerwj 13y ago
  ?
- deleted 13y ago
  [deleted]
- biot 13y ago
  My neighbor left their front door unlocked while they were on vacation. I kindly locked their door and notified them and they sent me a nice bottle of wine in thanks. What a total slap in the face. A security vulnerability like that, I should be entitled to at least a home-cooked dinner invite. Now if you'll excuse me, I have a whiny blog post to write and I will also be embarrassing myself on Twitter via a series of self-entitled rants showing to the world how insecure I am.
  - peapicker 13y ago
    Perfect reply, reframing the situation nicely.
    - hveragerdi 13y ago
      Is it? Lets see, the average monthly income in the states is about $4k. A decent cheap wine bottle is about $10. Now compare that to Yahoo's income and that $12 store credit they gave him. A more accurate scenario would be if the neighbours sent him the wine cork.
  - jessaustin 13y ago
    So you're saying: neighbor family : nice bottle wine :: hundreds of thousands of customers : t-shirt Hmmm. Your value function appears not to monotonically increase.
    - cnlwsu 13y ago
      do something nice for someone where they offered no reward : they gave me something because they thought it was nice do something for someone who never offered to give you anything but you expected a thousand dollars anyway : they gave me something because they thought it was nice
  - post_break 13y ago
    Except replace neighbor with corporation worth millions if not a billion and millions of users, unlocked door with door wide open, and vacation with home 24/7. Also if a nice bottle of wine costs $100 from a neighbor making a median of 100K a year scale it up to a company with the profits of Yahoo and do the math on a tshirt. What's it worth to Yahoo if someone finds an exploit that can expose all users? A friendly smile and handshake? Or another snarky reply on the internet.
jevinskie 13y ago
Sounds like they "got the picture" and changed their vulnerability reward system overnight to closely match their competitors. I can't think of a much better reaction than this.
drharris 13y ago
People who imploded over this should be embarrassed. Here's a guy who was doing more than the company policy just to be nice, and everyone turns into complainypants over their perceived entitlement. Good on the company for course-correcting and instituting a proper reward program, but the way this was handled by the technical crowd is embarrassing.
- badman_ting 13y ago
  The apology is a good one, and I feel bad for this person. But I don't think that retroactively changes how bad this looked originally.
  - drharris 13y ago
    It looked bad at first glance, but keep in mind they had no bug bounty program. Information about vulnerability reporting never said there would be a reward. Security bounties are a fairly recent trend, and I'd wager 99% of the web has no such policy in place. Maybe we expect the bigger companies to have one, but there's no guarantee. In the end, when no bounty is promised up-front, you can either take the low road and sell it on a forum, or take the high road and enjoy your T-shirt. Whether or not you're a good or bad citizen is up to you.
- smackfu 13y ago
  >Here's a guy who was doing more than the company policy just to be nice Was that clear at all before, or was the "reward" just coming from generic Yahoo? It seems like he was essentially creating a de facto company policy, without company approval.
- wpietri 13y ago
  The guy was awesome, and should be commended. But I don't yet see any reason to think Yahoo as an organization didn't fuck this up.
  - mayanksinghal 13y ago
    They didn't have a bounty program set up, like many if not most companies. I don't see a fuck up.
emhart 13y ago
I not only appreciate what they are trying to do moving forward, but also the entirely good natured, reasonable tone of the whole message. He explains without getting defensive and, in my opinion, helps Yahoo come out of this with a potential PR win. Well done.
- sjtgraham 13y ago
  Agreed, this is an excellent apology. No "sorry if you were upset" conditional apologies here, just a straight up "here is where we dropped the ball, and here is what we have fixed so it doesn't happen again; we're sorry". Brilliantly handled.
  - ars_technician 13y ago
    Except it doesn't actually have the "we're sorry" part. :-)
  - r00fus 13y ago
    And the new policy is backdated... which just happens to cover those folks who complained about getting tshirts.
    - simonebrunozzi 13y ago
      That's the genius part. Super smart. Well played.
- mildtrepidation 13y ago
  Agreed; hopefully the people who got upset will get some clarity from this and everyone will come out ahead. Personally, I think it's ridiculous that this was blown so far out of proportion, all because someone went above and beyond with his own resources trying to thank reporters. But then I don't have both sides of the story and, frankly, I'm not going to go looking for internet anger to figure it out.
- kamjam 13y ago
  And then yesterday morning “t-shirt-gate” hit. My inbox was full of angry email from people inside and out of Yahoo. How dare I send just a t-shirt to people as a thanks? Guy tries to do something nice and gets a big slap on the face. I can imagine this reaction from those outside of Yahoo wanting big rewards for their discoveries, sad to hear it was coming from internal as well.
elliottcarlson 13y ago
(Note, I technically work for Yahoo - but this is all personal opinion) Great on Yahoo for putting a reward program in place, but when did everyone become so entitled to getting something for reporting a bug/security concern. If you stumble on to an issue, and you are a good person, submit the report. If you are looking to make a living off of finding bugs, go directly to the companies that actually have a reward program in place. Don't be mad when you get a thank you gift that wasn't what you expected. Don't get mad at your security report not meeting guidelines.
- forgottenpass 13y ago
  when did everyone become so entitled to getting something for reporting a bug/security concern Sometime around the point where: - Yahoo!'s competition started offering bounties, and - "Entitlement" became a rhetorical tool to dismiss discussion of any business practice that might cost money
  - elliottcarlson 13y ago
    This has nothing to do with Yahoo - this has to do with every time there is someone complaining about them not receiving the bounty they wanted - and in this case about getting a t-shirt as a thank you. I am happy Yahoo is putting a reward program in to place - but the general commentary from the community annoys me.
    - thaumaturgy 13y ago
      It's simple pragmatism. I'd expect that HN, of all places, would get this. (And most seem to.) You are a security "researcher". Maybe that means you work with a group of bona-fide professionals, maybe that means you're still in high school. Either way, you have the capability to break things. But, breaking things isn't trivial; you don't expect to spend a few minutes "poking around" and come up with something, especially something interesting. So you have some choices. You can: try to break things which will give you rewards proportional to the time you spent and the severity of what you find; try to break things which will give you almost no official reward at all; or try to break things and then sell the solution to the highest bidder or make use of it yourself. (Let's assume that people aren't generally in the habit of working for free.) Now then. You're Yahoo, with millions of user accounts and a not-great track record for security. What would you prefer for the hacker to do, and how would you incentivize them to do it? You can gripe about "the community" or "entitlement" all you want -- until it becomes sufficiently annoying or unproductive -- but that won't change the end result, which is that companies which give substantial rewards for bug bounties are creating a marketplace where they win by getting lots of good talent to examine their systems without paying by the hour or day for it and the company gets first dibs on the details of the bug. Companies which don't do this, lose.
gadders 13y ago
No good deed goes unpunished.
forgottenpass 13y ago
A t-shirt is a great gesture from a dude, but a terrible one from Yahoo! It's too bad that, in his role, he was or appeared to be acting on behalf of yahoo. The impermeability of corporate behavior meant nobody on the outside really knew the difference before now.
- frankdenbow 13y ago
  This can work well from a company also, its just that expectations should be met. We (Startup Threads) ship out shirts via API for companies and its overwhelmingly a positive response for recipients, as its done as a thank you for something that normally doesn't elicit a payment/attention (like bounties for vulnerabilities would)
ximeng 13y ago
http://matthewshapiro.tumblr.com/post/62962519266/yahoo-developer-network-so-im-the-guy-who-sent-the http://matthewshapiro.tumblr.com/post/62962519266/yahoo-deve... I really don't get the response above.
- droopybuns 13y ago
  No joke. What an unmitigated douchebag. I work with so many people who have no hustle. No compulsion to go above and beyond the constraints of the situation. This position openly advocates that employees should only be workerbee drones who stay within the rules of their corporate overlords and/or Only succeed, never make mistakes. Both are fatally toxic attitudes. Fuck Matthew Shapiro.
- geofft 13y ago
  Every single post on the first page of this guy's Tumblr is angry at someone or something. Who is this guy, and why are his opinions on management relevant?
eloff 13y ago
If I were a security researcher and put a lot of effort into finding vulnerabilities for Yahoo I would have simply sold the exploits to the highest bidder, and invited Yahoo to participate in the auction. If they lost, then I'd go to the press with the story of how little their user's security means to them (again to the highest bidder.) Either way, (only in the long run in the second case), the users win and I'd sleep like a baby. It's just as well I'm not a security researcher. Edit: Wow a lot of drive-by-downvotes. I'm not serious guys, but I hope I have made some people think about the moral issues involved. It's not as clear as people are making it out to be in other comments on this post.
- umsm 13y ago
  That's a wrong way of looking at the situation.
  - eloff 13y ago
    You could just state that I'm wrong, or you could explain why you think that. The second is valuable, the first is a waste of a comment. Edit: why would anyone downvote this? Other than the owner of the useless comment anyway... For the record, comments on HN should have substance, it's in the guidelines when you signed up.
    - jessaustin 13y ago
      Edit: why would anyone downvote this? It's my policy to downvote any comment that complains about downvoting. However, it would be better in this case to not even respond to GP's inane scribbling. Trust the downvoters to get around to it eventually.
      - eloff 13y ago
        I prefer giving reasons why behavior should be corrected as opposed to downvoting and hoping they can divine why they were downvoted (like whoever downvoted my comment with the reason why his comment was bad, I have no clue what they objected to, so they accomplished little.)
umsm 13y ago
I feel like this is a stupid question, but: Why would people get mad at him for sending out t-shirts (i.e. tshirt-gate)?
- duskwuff 13y ago
  Because they weren't sending out T-shirts; they were sending out gift certificates for $12. When it's presented that way, it feels like Yahoo is trying to say that's all the report was worth to them.
  - aestra 13y ago
    It's like this. Imagine if you were outside shoveling a decent amount of snow then your neighbor asked you to help shovel his property. If you haven't shoveled snow before, it can be a somewhat laborious task. After you were finished your neighbor said "Thanks for helping me out" and then gave you 50 cents. It would have been better if they just said "thanks."
    - talmand 13y ago
      Then that makes you a somewhat bad neighbor. Did the neighbor promise to give something in return before you began? Because if you start something with no promise of anything in return, then you shouldn't expect more than a thank you. To perform such a favor, then to expect something in return that was not offered reflects badly on you. Or maybe your analogy doesn't work in this case.
      - aestra 13y ago
        Wow. You complete and totally 100% missed the point of my story. I used the example of neighbors because they are (in some neighbors) neighborly, and do altruistic things for each other. When there is a big snowfall in my neighborhood, all my neighbors come out and help each other shovel. There is mostly apartments here, so very few people own a snow blower and everyone needs to dig their cars out. I live alone and whenever someone sees me shoveling by myself, someone always comes over and helps me shovel without expectation of anything in return and its always a different person from last time. When I make baked goods, I usually stop by the people who live in my building's apartments to see if they would like some of what I made. I once needed help carrying something up the stairs, so I just knocked on a neighbor's door and he came out to help me. This it the neighbor who doesn't have to pay for internet because I let him use my WiFi. There's somewhat of an "rule" if someone is in need of something, they just need to ask, and everything works because the give and take is pretty even, nobody takes and takes and takes without giving. The point is, the person shoveling snow did it to be nice, and to help a neighbor out. Once the person being helped offered a reward in return, they are now putting a monetary value on the help they received and the value was insultingly low, saying "this is how much I value you." If they just said "Thank you very much" then it just remains as an altruistic gift to the community. I used the neighbor example to make altruism more evident, to not think of it from a purely business prospective. Yahoo have 2 choices to not offend people: 1) Bug finding is simply an altruistic act from the community. 2) Pair fair compensation.
ukjamster 13y ago
Good result. Yahoo come out of this looking human and responsible. High-Tech Bridge have helped raise security standards.
joshdance 13y ago
I just felt the first bit of positive goodwill towards Yahoo I have felt in a while. It is important to recognize that behind more company actions and policies, there are people. Sometimes doing the best they can.
Simple1234 13y ago
I Google or Yahoo rewarded minor bugs. They should care about 404s or a tool tip bubble with no tip. I find minor bugs on all major websites all the time.
- freehunter 13y ago
  Problem is, minor bugs like a 404 don't majorly impact their operations as much as being able to get into someone else's email or reset someone else's password. Typos aren't worth anything when it comes down to impact to business.
daeken 13y ago
As a security researcher and someone who regularly participates in bug bounties, thank you. You didn't have to do what you did, but you did it anyway, just to be nice; that should be applauded, not criticized. Remember everyone: if there's no bounty program in place, reporting bugs means that your expected value for those bugs is $0. If you get more than that, that's awesome, but don't expect it, or act like it's deserved; it's not. Enjoy your Yahoo swag and go on with life.
- tomjen3 13y ago
  I am fine with getting nothing, but I will get angry if you insult me after I just helped you. And telling me my skills are worth less than minimum wage (assuming it took more than 3 hours to find the bug _is insulting_).
  - daeken 13y ago
    This is asinine. You ask your friends to help you move, and they happily agree -- they're your friends, right? So they come over, they help you move for 5 or 6 hours. Once it's completed, you get some beer and pizza for everyone. The nominal value of those items is what, $5-6 per person? Holy crap, you just told your friend that their time is only worth $1/hr! Yahoo didn't agree to give you money, didn't hire you to test, and didn't even say "hey, can you take a look at this?". It's completely irrational to then say that a gift that they provided you is an insult. In fact, I'll go further: it reflects very poorly on your own character, and not theirs.
  - x3c 13y ago
    I spent 10 minutes reading your comment, parsing it and then responding to it. You owe me $5.
    - chris_wot 13y ago
      You spent 10 minutes reading that comment before you understood it?!?
  - aaron695 13y ago
Ntrails 13y ago
I don't know what the T-Shirt looked like, but I am imagining it is a "I reported a critical bug that affected millions of users and all I got was this stupid T-Shirt" kind of thing. Which, frankly, was a pretty cool gesture of thanks from the person writing. In a way I'd like them to keep the T-Shirts regardless of adding the monetary bounty.
- homakov 13y ago
  > I reported a critical bug that affected millions of users > XSS lol
mgkimsal 13y ago
A year from now people will be wanting the shirt instead of $150, because it'll be 'cool' and a visible way of showing off instead of just having an extra $150 in your account.
truthyness 13y ago
So, isn't it just totally precious how ENTERTAINERS like us begin our postings with the completely unnecessary "So..." ?
protomyth 13y ago
I guess a Yahoo shirt isn't quite the recognition factor of a very small check from Knuth. I dearly hate when someone spends their own money and basically gets the shaft. People wonder why individuals aren't nice.
willvarfar 13y ago
Reminds me of Knuth sending cheques for corrections to his books; like Picasso's doodles, pity the fools who cash them :)
homakov 13y ago
As a bug hunter, I think initial problem is bullshit. There is NO POLICY about rewards in Yahoo. Nobody has right to "beg" a reward. Especially for "yet another XSS". Don't like the policy? Go sell that "XSS" if you can (nobody buys it btw).
650REDHAIR 13y ago
Excellent post. Really loved the last line- "This includes, of course, a check for the researchers at High-Tech Bridge who didn’t like my t-shirt."
ianhawes 13y ago
Anyone else catch that their security group is called "Yahoo Paranoids"? Hilarious!
joelrunyon 13y ago
Anyone else impressed someone actually came forward and said "it's on me"? Sad to say it but this actually surprises me.
wavesounds 13y ago
I like how Yahoo is paying someone to post gifs on tumblr every day: http://yahoomessenger.tumblr.com/ http://yahoomessenger.tumblr.com/
mknappen 13y ago
Did Ramses Martinez have the authority to pay people who found issues and instead sent tee shirts? Have people been paid in the past? If yes to both, the "no good deed goes unpunished" and "I'm new here so lay off" response is disingenuous. However, if there was no way Martinez could have paid bounties or no history of payouts, the grumpy response to not being showered with cash is unreasonable. (And perhaps Martinez, et al., already knew of this particular vulnerability.)
jlgaddis 13y ago
I'm still impressed that companies reward the reporting of security issues, whether it's sending a small "thank you" gift, posting one's name on a "hall of fame" page, or cutting them a check. In the mid-90's, I notified a company of a major security vulnerability and all I got was a visit from the FBI and my computer taken away for 16 months. We've sure came a long way!
wesleyac 13y ago
Thank you for reminding me to think before I start complaining.

359 points by jnazario 13y ago

bhuga 13y ago

A classy, concrete response in a human voice. This is exactly how great companies communicate. Putting together a bug bounty program for a company like Yahoo is a lot of hard work with tons of tiny gotchas. It can take forever, and it's never ready when it needs to be. Looking forward to it.

jnazario 13y ago

note: ramses is a friend. so while i can't speak for him, what i can say is that i've known him for many years, worked closely with him on very large, global issues, and have found him to be a very standup, forthright guy who strives to make the world a better place.

sjtgraham 13y ago
It's very nice that he bought t-shirts at his own personal expense. He comes over as such a conscientious person that I feel bad "t-shirt-gate" happened.

santosha 13y ago

Good on them.

post_break 13y ago

Seems like too little too late. The tshirt thing might have been in good faith, but wow was it a slap in the face. I wouldn't be surprised if exploits were sold for less than what they could fetch from Yahoo as a sort of candid rebellion. I'd love to see someone find an exploit, and then send Yahoo a shirt.

jevinskie 13y ago
What else do you want them to do? They are even making the new policy retroactive back to July.
alanctgardner2 13y ago
A slap in the face? I know bug bounty programs are a very good idea, no arguments. If a company doesn't have a formally posted bug bounty, though, I wouldn't be looking for vulnerabilities for money. Approaching a company with no formal structure in place to assess or pay out bounties, and saying 'you owe me a bunch of money' is never going to be a winning proposition. I think what this guy was doing was awesome; he clearly understands the value of the work researchers were doing, and he did what was in his power to thank them. Compared to getting no reaction, or a terse email, this is probably in the top 20% of responses to random vulnerability disclosures.
elliottcarlson 13y ago
This is self-entitled bullshit. If you (not you, but people in general) want to make a living off of reporting bugs, then get a job in the field, or know which companies are explicitly paying bounties. How is that expectation of a reward anything more than blackmail?
- post_break 13y ago
  You're coming at this all wrong. Take a step back and think about the users. Imagine your a Yahoo user and you learn that a hacker finds an exploit to take over accounts and tries to submit it to the company. They in tern send him a tshirt a friendly smile and a handshake. What does that tell you about the company? Does that make you feel like your account, data, etc is secure and more exploits will just be handed over? It's not about the money, it's about sending a message. And instead of chaos and people wearing masks, we've got vulnerabilities, and the idea the Yahoo actually values its users.
- deleted 13y ago
  [deleted]
wheelerwj 13y ago
?
deleted 13y ago
[deleted]
biot 13y ago
My neighbor left their front door unlocked while they were on vacation. I kindly locked their door and notified them and they sent me a nice bottle of wine in thanks. What a total slap in the face. A security vulnerability like that, I should be entitled to at least a home-cooked dinner invite. Now if you'll excuse me, I have a whiny blog post to write and I will also be embarrassing myself on Twitter via a series of self-entitled rants showing to the world how insecure I am.
- peapicker 13y ago
  Perfect reply, reframing the situation nicely.
  - hveragerdi 13y ago
    Is it? Lets see, the average monthly income in the states is about $4k. A decent cheap wine bottle is about $10. Now compare that to Yahoo's income and that $12 store credit they gave him. A more accurate scenario would be if the neighbours sent him the wine cork.
- jessaustin 13y ago
  So you're saying: neighbor family : nice bottle wine :: hundreds of thousands of customers : t-shirt Hmmm. Your value function appears not to monotonically increase.
  - cnlwsu 13y ago
    do something nice for someone where they offered no reward : they gave me something because they thought it was nice do something for someone who never offered to give you anything but you expected a thousand dollars anyway : they gave me something because they thought it was nice
- post_break 13y ago
  Except replace neighbor with corporation worth millions if not a billion and millions of users, unlocked door with door wide open, and vacation with home 24/7. Also if a nice bottle of wine costs $100 from a neighbor making a median of 100K a year scale it up to a company with the profits of Yahoo and do the math on a tshirt. What's it worth to Yahoo if someone finds an exploit that can expose all users? A friendly smile and handshake? Or another snarky reply on the internet.

jevinskie 13y ago

Sounds like they "got the picture" and changed their vulnerability reward system overnight to closely match their competitors. I can't think of a much better reaction than this.

drharris 13y ago

People who imploded over this should be embarrassed. Here's a guy who was doing more than the company policy just to be nice, and everyone turns into complainypants over their perceived entitlement. Good on the company for course-correcting and instituting a proper reward program, but the way this was handled by the technical crowd is embarrassing.

badman_ting 13y ago
The apology is a good one, and I feel bad for this person. But I don't think that retroactively changes how bad this looked originally.
- drharris 13y ago
  It looked bad at first glance, but keep in mind they had no bug bounty program. Information about vulnerability reporting never said there would be a reward. Security bounties are a fairly recent trend, and I'd wager 99% of the web has no such policy in place. Maybe we expect the bigger companies to have one, but there's no guarantee. In the end, when no bounty is promised up-front, you can either take the low road and sell it on a forum, or take the high road and enjoy your T-shirt. Whether or not you're a good or bad citizen is up to you.
smackfu 13y ago
>Here's a guy who was doing more than the company policy just to be nice Was that clear at all before, or was the "reward" just coming from generic Yahoo? It seems like he was essentially creating a de facto company policy, without company approval.
wpietri 13y ago
The guy was awesome, and should be commended. But I don't yet see any reason to think Yahoo as an organization didn't fuck this up.
- mayanksinghal 13y ago
  They didn't have a bounty program set up, like many if not most companies. I don't see a fuck up.

emhart 13y ago

I not only appreciate what they are trying to do moving forward, but also the entirely good natured, reasonable tone of the whole message. He explains without getting defensive and, in my opinion, helps Yahoo come out of this with a potential PR win. Well done.

sjtgraham 13y ago
Agreed, this is an excellent apology. No "sorry if you were upset" conditional apologies here, just a straight up "here is where we dropped the ball, and here is what we have fixed so it doesn't happen again; we're sorry". Brilliantly handled.
- ars_technician 13y ago
  Except it doesn't actually have the "we're sorry" part. :-)
- r00fus 13y ago
  And the new policy is backdated... which just happens to cover those folks who complained about getting tshirts.
  - simonebrunozzi 13y ago
    That's the genius part. Super smart. Well played.
mildtrepidation 13y ago
Agreed; hopefully the people who got upset will get some clarity from this and everyone will come out ahead. Personally, I think it's ridiculous that this was blown so far out of proportion, all because someone went above and beyond with his own resources trying to thank reporters. But then I don't have both sides of the story and, frankly, I'm not going to go looking for internet anger to figure it out.
kamjam 13y ago
And then yesterday morning “t-shirt-gate” hit. My inbox was full of angry email from people inside and out of Yahoo. How dare I send just a t-shirt to people as a thanks? Guy tries to do something nice and gets a big slap on the face. I can imagine this reaction from those outside of Yahoo wanting big rewards for their discoveries, sad to hear it was coming from internal as well.

elliottcarlson 13y ago

(Note, I technically work for Yahoo - but this is all personal opinion) Great on Yahoo for putting a reward program in place, but when did everyone become so entitled to getting something for reporting a bug/security concern. If you stumble on to an issue, and you are a good person, submit the report. If you are looking to make a living off of finding bugs, go directly to the companies that actually have a reward program in place. Don't be mad when you get a thank you gift that wasn't what you expected. Don't get mad at your security report not meeting guidelines.

forgottenpass 13y ago
when did everyone become so entitled to getting something for reporting a bug/security concern Sometime around the point where: - Yahoo!'s competition started offering bounties, and - "Entitlement" became a rhetorical tool to dismiss discussion of any business practice that might cost money
- elliottcarlson 13y ago
  This has nothing to do with Yahoo - this has to do with every time there is someone complaining about them not receiving the bounty they wanted - and in this case about getting a t-shirt as a thank you. I am happy Yahoo is putting a reward program in to place - but the general commentary from the community annoys me.
  - thaumaturgy 13y ago
    It's simple pragmatism. I'd expect that HN, of all places, would get this. (And most seem to.) You are a security "researcher". Maybe that means you work with a group of bona-fide professionals, maybe that means you're still in high school. Either way, you have the capability to break things. But, breaking things isn't trivial; you don't expect to spend a few minutes "poking around" and come up with something, especially something interesting. So you have some choices. You can: try to break things which will give you rewards proportional to the time you spent and the severity of what you find; try to break things which will give you almost no official reward at all; or try to break things and then sell the solution to the highest bidder or make use of it yourself. (Let's assume that people aren't generally in the habit of working for free.) Now then. You're Yahoo, with millions of user accounts and a not-great track record for security. What would you prefer for the hacker to do, and how would you incentivize them to do it? You can gripe about "the community" or "entitlement" all you want -- until it becomes sufficiently annoying or unproductive -- but that won't change the end result, which is that companies which give substantial rewards for bug bounties are creating a marketplace where they win by getting lots of good talent to examine their systems without paying by the hour or day for it and the company gets first dibs on the details of the bug. Companies which don't do this, lose.

gadders 13y ago

No good deed goes unpunished.

forgottenpass 13y ago

A t-shirt is a great gesture from a dude, but a terrible one from Yahoo! It's too bad that, in his role, he was or appeared to be acting on behalf of yahoo. The impermeability of corporate behavior meant nobody on the outside really knew the difference before now.

frankdenbow 13y ago
This can work well from a company also, its just that expectations should be met. We (Startup Threads) ship out shirts via API for companies and its overwhelmingly a positive response for recipients, as its done as a thank you for something that normally doesn't elicit a payment/attention (like bounties for vulnerabilities would)

ximeng 13y ago

http://matthewshapiro.tumblr.com/post/62962519266/yahoo-developer-network-so-im-the-guy-who-sent-the http://matthewshapiro.tumblr.com/post/62962519266/yahoo-deve... I really don't get the response above.

droopybuns 13y ago
No joke. What an unmitigated douchebag. I work with so many people who have no hustle. No compulsion to go above and beyond the constraints of the situation. This position openly advocates that employees should only be workerbee drones who stay within the rules of their corporate overlords and/or Only succeed, never make mistakes. Both are fatally toxic attitudes. Fuck Matthew Shapiro.
geofft 13y ago
Every single post on the first page of this guy's Tumblr is angry at someone or something. Who is this guy, and why are his opinions on management relevant?

eloff 13y ago

If I were a security researcher and put a lot of effort into finding vulnerabilities for Yahoo I would have simply sold the exploits to the highest bidder, and invited Yahoo to participate in the auction. If they lost, then I'd go to the press with the story of how little their user's security means to them (again to the highest bidder.) Either way, (only in the long run in the second case), the users win and I'd sleep like a baby. It's just as well I'm not a security researcher. Edit: Wow a lot of drive-by-downvotes. I'm not serious guys, but I hope I have made some people think about the moral issues involved. It's not as clear as people are making it out to be in other comments on this post.

umsm 13y ago
That's a wrong way of looking at the situation.
- eloff 13y ago
  You could just state that I'm wrong, or you could explain why you think that. The second is valuable, the first is a waste of a comment. Edit: why would anyone downvote this? Other than the owner of the useless comment anyway... For the record, comments on HN should have substance, it's in the guidelines when you signed up.
  - jessaustin 13y ago
    Edit: why would anyone downvote this? It's my policy to downvote any comment that complains about downvoting. However, it would be better in this case to not even respond to GP's inane scribbling. Trust the downvoters to get around to it eventually.
    - eloff 13y ago
      I prefer giving reasons why behavior should be corrected as opposed to downvoting and hoping they can divine why they were downvoted (like whoever downvoted my comment with the reason why his comment was bad, I have no clue what they objected to, so they accomplished little.)

umsm 13y ago

I feel like this is a stupid question, but: Why would people get mad at him for sending out t-shirts (i.e. tshirt-gate)?

duskwuff 13y ago
Because they weren't sending out T-shirts; they were sending out gift certificates for $12. When it's presented that way, it feels like Yahoo is trying to say that's all the report was worth to them.
- aestra 13y ago
  It's like this. Imagine if you were outside shoveling a decent amount of snow then your neighbor asked you to help shovel his property. If you haven't shoveled snow before, it can be a somewhat laborious task. After you were finished your neighbor said "Thanks for helping me out" and then gave you 50 cents. It would have been better if they just said "thanks."
  - talmand 13y ago
    Then that makes you a somewhat bad neighbor. Did the neighbor promise to give something in return before you began? Because if you start something with no promise of anything in return, then you shouldn't expect more than a thank you. To perform such a favor, then to expect something in return that was not offered reflects badly on you. Or maybe your analogy doesn't work in this case.
    - aestra 13y ago
      Wow. You complete and totally 100% missed the point of my story. I used the example of neighbors because they are (in some neighbors) neighborly, and do altruistic things for each other. When there is a big snowfall in my neighborhood, all my neighbors come out and help each other shovel. There is mostly apartments here, so very few people own a snow blower and everyone needs to dig their cars out. I live alone and whenever someone sees me shoveling by myself, someone always comes over and helps me shovel without expectation of anything in return and its always a different person from last time. When I make baked goods, I usually stop by the people who live in my building's apartments to see if they would like some of what I made. I once needed help carrying something up the stairs, so I just knocked on a neighbor's door and he came out to help me. This it the neighbor who doesn't have to pay for internet because I let him use my WiFi. There's somewhat of an "rule" if someone is in need of something, they just need to ask, and everything works because the give and take is pretty even, nobody takes and takes and takes without giving. The point is, the person shoveling snow did it to be nice, and to help a neighbor out. Once the person being helped offered a reward in return, they are now putting a monetary value on the help they received and the value was insultingly low, saying "this is how much I value you." If they just said "Thank you very much" then it just remains as an altruistic gift to the community. I used the neighbor example to make altruism more evident, to not think of it from a purely business prospective. Yahoo have 2 choices to not offend people: 1) Bug finding is simply an altruistic act from the community. 2) Pair fair compensation.

ukjamster 13y ago

Good result. Yahoo come out of this looking human and responsible. High-Tech Bridge have helped raise security standards.

joshdance 13y ago

I just felt the first bit of positive goodwill towards Yahoo I have felt in a while. It is important to recognize that behind more company actions and policies, there are people. Sometimes doing the best they can.

Simple1234 13y ago

I Google or Yahoo rewarded minor bugs. They should care about 404s or a tool tip bubble with no tip. I find minor bugs on all major websites all the time.

freehunter 13y ago
Problem is, minor bugs like a 404 don't majorly impact their operations as much as being able to get into someone else's email or reset someone else's password. Typos aren't worth anything when it comes down to impact to business.

daeken 13y ago

As a security researcher and someone who regularly participates in bug bounties, thank you. You didn't have to do what you did, but you did it anyway, just to be nice; that should be applauded, not criticized. Remember everyone: if there's no bounty program in place, reporting bugs means that your expected value for those bugs is $0. If you get more than that, that's awesome, but don't expect it, or act like it's deserved; it's not. Enjoy your Yahoo swag and go on with life.

tomjen3 13y ago
I am fine with getting nothing, but I will get angry if you insult me after I just helped you. And telling me my skills are worth less than minimum wage (assuming it took more than 3 hours to find the bug _is insulting_).
- daeken 13y ago
  This is asinine. You ask your friends to help you move, and they happily agree -- they're your friends, right? So they come over, they help you move for 5 or 6 hours. Once it's completed, you get some beer and pizza for everyone. The nominal value of those items is what, $5-6 per person? Holy crap, you just told your friend that their time is only worth $1/hr! Yahoo didn't agree to give you money, didn't hire you to test, and didn't even say "hey, can you take a look at this?". It's completely irrational to then say that a gift that they provided you is an insult. In fact, I'll go further: it reflects very poorly on your own character, and not theirs.
- x3c 13y ago
  I spent 10 minutes reading your comment, parsing it and then responding to it. You owe me $5.
  - chris_wot 13y ago
    You spent 10 minutes reading that comment before you understood it?!?
- aaron695 13y ago

Ntrails 13y ago

I don't know what the T-Shirt looked like, but I am imagining it is a "I reported a critical bug that affected millions of users and all I got was this stupid T-Shirt" kind of thing. Which, frankly, was a pretty cool gesture of thanks from the person writing. In a way I'd like them to keep the T-Shirts regardless of adding the monetary bounty.

homakov 13y ago
> I reported a critical bug that affected millions of users > XSS lol

mgkimsal 13y ago

A year from now people will be wanting the shirt instead of $150, because it'll be 'cool' and a visible way of showing off instead of just having an extra $150 in your account.

truthyness 13y ago

So, isn't it just totally precious how ENTERTAINERS like us begin our postings with the completely unnecessary "So..." ?

protomyth 13y ago

I guess a Yahoo shirt isn't quite the recognition factor of a very small check from Knuth. I dearly hate when someone spends their own money and basically gets the shaft. People wonder why individuals aren't nice.

willvarfar 13y ago

Reminds me of Knuth sending cheques for corrections to his books; like Picasso's doodles, pity the fools who cash them :)

homakov 13y ago

As a bug hunter, I think initial problem is bullshit. There is NO POLICY about rewards in Yahoo. Nobody has right to "beg" a reward. Especially for "yet another XSS". Don't like the policy? Go sell that "XSS" if you can (nobody buys it btw).

650REDHAIR 13y ago

Excellent post. Really loved the last line- "This includes, of course, a check for the researchers at High-Tech Bridge who didn’t like my t-shirt."

ianhawes 13y ago

Anyone else catch that their security group is called "Yahoo Paranoids"? Hilarious!

joelrunyon 13y ago

Anyone else impressed someone actually came forward and said "it's on me"? Sad to say it but this actually surprises me.

wavesounds 13y ago

I like how Yahoo is paying someone to post gifs on tumblr every day: http://yahoomessenger.tumblr.com/ http://yahoomessenger.tumblr.com/

mknappen 13y ago

Did Ramses Martinez have the authority to pay people who found issues and instead sent tee shirts? Have people been paid in the past? If yes to both, the "no good deed goes unpunished" and "I'm new here so lay off" response is disingenuous. However, if there was no way Martinez could have paid bounties or no history of payouts, the grumpy response to not being showered with cash is unreasonable. (And perhaps Martinez, et al., already knew of this particular vulnerability.)

jlgaddis 13y ago

I'm still impressed that companies reward the reporting of security issues, whether it's sending a small "thank you" gift, posting one's name on a "hall of fame" page, or cutting them a check. In the mid-90's, I notified a company of a major security vulnerability and all I got was a visit from the FBI and my computer taken away for 16 months. We've sure came a long way!

wesleyac 13y ago

Thank you for reminding me to think before I start complaining.