4 ms·

Seems like too little too late. The tshirt thing might have been in good faith, but wow was it a slap in the face. I wouldn't be surprised if exploits were sold

Seems like too little too late. The tshirt thing might have been in good faith, but wow was it a slap in the face. I wouldn't be surprised if exploits were sold for less than what they could fetch from Yahoo as a sort of candid rebellion. I'd love to see someone find an exploit, and then send Yahoo a shirt.

jevinskie 13y ago
What else do you want them to do? They are even making the new policy retroactive back to July.
alanctgardner2 13y ago
A slap in the face? I know bug bounty programs are a very good idea, no arguments. If a company doesn't have a formally posted bug bounty, though, I wouldn't be looking for vulnerabilities for money. Approaching a company with no formal structure in place to assess or pay out bounties, and saying 'you owe me a bunch of money' is never going to be a winning proposition. I think what this guy was doing was awesome; he clearly understands the value of the work researchers were doing, and he did what was in his power to thank them. Compared to getting no reaction, or a terse email, this is probably in the top 20% of responses to random vulnerability disclosures.
elliottcarlson 13y ago
This is self-entitled bullshit. If you (not you, but people in general) want to make a living off of reporting bugs, then get a job in the field, or know which companies are explicitly paying bounties. How is that expectation of a reward anything more than blackmail?
- post_break 13y ago
  You're coming at this all wrong. Take a step back and think about the users. Imagine your a Yahoo user and you learn that a hacker finds an exploit to take over accounts and tries to submit it to the company. They in tern send him a tshirt a friendly smile and a handshake. What does that tell you about the company? Does that make you feel like your account, data, etc is secure and more exploits will just be handed over? It's not about the money, it's about sending a message. And instead of chaos and people wearing masks, we've got vulnerabilities, and the idea the Yahoo actually values its users.
- deleted 13y ago
  [deleted]
wheelerwj 13y ago
?
deleted 13y ago
[deleted]
biot 13y ago
My neighbor left their front door unlocked while they were on vacation. I kindly locked their door and notified them and they sent me a nice bottle of wine in thanks. What a total slap in the face. A security vulnerability like that, I should be entitled to at least a home-cooked dinner invite. Now if you'll excuse me, I have a whiny blog post to write and I will also be embarrassing myself on Twitter via a series of self-entitled rants showing to the world how insecure I am.
- peapicker 13y ago
  Perfect reply, reframing the situation nicely.
  - hveragerdi 13y ago
    Is it? Lets see, the average monthly income in the states is about $4k. A decent cheap wine bottle is about $10. Now compare that to Yahoo's income and that $12 store credit they gave him. A more accurate scenario would be if the neighbours sent him the wine cork.
- jessaustin 13y ago
  So you're saying: neighbor family : nice bottle wine :: hundreds of thousands of customers : t-shirt Hmmm. Your value function appears not to monotonically increase.
  - cnlwsu 13y ago
    do something nice for someone where they offered no reward : they gave me something because they thought it was nice do something for someone who never offered to give you anything but you expected a thousand dollars anyway : they gave me something because they thought it was nice
- post_break 13y ago
  Except replace neighbor with corporation worth millions if not a billion and millions of users, unlocked door with door wide open, and vacation with home 24/7. Also if a nice bottle of wine costs $100 from a neighbor making a median of 100K a year scale it up to a company with the profits of Yahoo and do the math on a tshirt. What's it worth to Yahoo if someone finds an exploit that can expose all users? A friendly smile and handshake? Or another snarky reply on the internet.

jevinskie 13y ago

What else do you want them to do? They are even making the new policy retroactive back to July.

alanctgardner2 13y ago

A slap in the face? I know bug bounty programs are a very good idea, no arguments. If a company doesn't have a formally posted bug bounty, though, I wouldn't be looking for vulnerabilities for money. Approaching a company with no formal structure in place to assess or pay out bounties, and saying 'you owe me a bunch of money' is never going to be a winning proposition. I think what this guy was doing was awesome; he clearly understands the value of the work researchers were doing, and he did what was in his power to thank them. Compared to getting no reaction, or a terse email, this is probably in the top 20% of responses to random vulnerability disclosures.

elliottcarlson 13y ago

This is self-entitled bullshit. If you (not you, but people in general) want to make a living off of reporting bugs, then get a job in the field, or know which companies are explicitly paying bounties. How is that expectation of a reward anything more than blackmail?

post_break 13y ago
You're coming at this all wrong. Take a step back and think about the users. Imagine your a Yahoo user and you learn that a hacker finds an exploit to take over accounts and tries to submit it to the company. They in tern send him a tshirt a friendly smile and a handshake. What does that tell you about the company? Does that make you feel like your account, data, etc is secure and more exploits will just be handed over? It's not about the money, it's about sending a message. And instead of chaos and people wearing masks, we've got vulnerabilities, and the idea the Yahoo actually values its users.
deleted 13y ago
[deleted]

wheelerwj 13y ago

deleted 13y ago

[deleted]

biot 13y ago

My neighbor left their front door unlocked while they were on vacation. I kindly locked their door and notified them and they sent me a nice bottle of wine in thanks. What a total slap in the face. A security vulnerability like that, I should be entitled to at least a home-cooked dinner invite. Now if you'll excuse me, I have a whiny blog post to write and I will also be embarrassing myself on Twitter via a series of self-entitled rants showing to the world how insecure I am.

peapicker 13y ago
Perfect reply, reframing the situation nicely.
- hveragerdi 13y ago
  Is it? Lets see, the average monthly income in the states is about $4k. A decent cheap wine bottle is about $10. Now compare that to Yahoo's income and that $12 store credit they gave him. A more accurate scenario would be if the neighbours sent him the wine cork.
jessaustin 13y ago
So you're saying: neighbor family : nice bottle wine :: hundreds of thousands of customers : t-shirt Hmmm. Your value function appears not to monotonically increase.
- cnlwsu 13y ago
  do something nice for someone where they offered no reward : they gave me something because they thought it was nice do something for someone who never offered to give you anything but you expected a thousand dollars anyway : they gave me something because they thought it was nice
post_break 13y ago
Except replace neighbor with corporation worth millions if not a billion and millions of users, unlocked door with door wide open, and vacation with home 24/7. Also if a nice bottle of wine costs $100 from a neighbor making a median of 100K a year scale it up to a company with the profits of Yahoo and do the math on a tshirt. What's it worth to Yahoo if someone finds an exploit that can expose all users? A friendly smile and handshake? Or another snarky reply on the internet.