3 ms·

People who imploded over this should be embarrassed. Here's a guy who was doing more than the company policy just to be nice, and everyone turns into complainyp

People who imploded over this should be embarrassed. Here's a guy who was doing more than the company policy just to be nice, and everyone turns into complainypants over their perceived entitlement. Good on the company for course-correcting and instituting a proper reward program, but the way this was handled by the technical crowd is embarrassing.

badman_ting 13y ago
The apology is a good one, and I feel bad for this person. But I don't think that retroactively changes how bad this looked originally.
- drharris 13y ago
  It looked bad at first glance, but keep in mind they had no bug bounty program. Information about vulnerability reporting never said there would be a reward. Security bounties are a fairly recent trend, and I'd wager 99% of the web has no such policy in place. Maybe we expect the bigger companies to have one, but there's no guarantee. In the end, when no bounty is promised up-front, you can either take the low road and sell it on a forum, or take the high road and enjoy your T-shirt. Whether or not you're a good or bad citizen is up to you.
smackfu 13y ago
>Here's a guy who was doing more than the company policy just to be nice Was that clear at all before, or was the "reward" just coming from generic Yahoo? It seems like he was essentially creating a de facto company policy, without company approval.
wpietri 13y ago
The guy was awesome, and should be commended. But I don't yet see any reason to think Yahoo as an organization didn't fuck this up.
- mayanksinghal 13y ago
  They didn't have a bounty program set up, like many if not most companies. I don't see a fuck up.
  - wpietri 13y ago
    I think any time your company gets so much bad public comment that they have to rush out a public apology for something that has received a "-gate" suffix, it's reasonable to call that a fuckup. They're surely paying a lot for their security team. And they know (or should have known) their competitors are offering substantial bug bounties. And they knew (or should have known) that one of their own people was spending significant time and money rewarding people reporting bugs. The managerial fuck-up I see is not putting those things together and saying, "Hey, we should have a real bug bounty program if we don't want to look like cheap jerks." Apparently they were trying to rectify that, which is great. But if I were a manager there, the question I'd be asking is, "Why did we take so long to recognize and respond to this problem?"

badman_ting 13y ago

The apology is a good one, and I feel bad for this person. But I don't think that retroactively changes how bad this looked originally.

drharris 13y ago
It looked bad at first glance, but keep in mind they had no bug bounty program. Information about vulnerability reporting never said there would be a reward. Security bounties are a fairly recent trend, and I'd wager 99% of the web has no such policy in place. Maybe we expect the bigger companies to have one, but there's no guarantee. In the end, when no bounty is promised up-front, you can either take the low road and sell it on a forum, or take the high road and enjoy your T-shirt. Whether or not you're a good or bad citizen is up to you.

smackfu 13y ago

>Here's a guy who was doing more than the company policy just to be nice Was that clear at all before, or was the "reward" just coming from generic Yahoo? It seems like he was essentially creating a de facto company policy, without company approval.

wpietri 13y ago

The guy was awesome, and should be commended. But I don't yet see any reason to think Yahoo as an organization didn't fuck this up.

mayanksinghal 13y ago
They didn't have a bounty program set up, like many if not most companies. I don't see a fuck up.
- wpietri 13y ago
  I think any time your company gets so much bad public comment that they have to rush out a public apology for something that has received a "-gate" suffix, it's reasonable to call that a fuckup. They're surely paying a lot for their security team. And they know (or should have known) their competitors are offering substantial bug bounties. And they knew (or should have known) that one of their own people was spending significant time and money rewarding people reporting bugs. The managerial fuck-up I see is not putting those things together and saying, "Hey, we should have a real bug bounty program if we don't want to look like cheap jerks." Apparently they were trying to rectify that, which is great. But if I were a manager there, the question I'd be asking is, "Why did we take so long to recognize and respond to this problem?"