7 ms·

(Note, I technically work for Yahoo - but this is all personal opinion) Great on Yahoo for putting a reward program in place, but when did everyone become so e

(Note, I technically work for Yahoo - but this is all personal opinion) Great on Yahoo for putting a reward program in place, but when did everyone become so entitled to getting something for reporting a bug/security concern. If you stumble on to an issue, and you are a good person, submit the report. If you are looking to make a living off of finding bugs, go directly to the companies that actually have a reward program in place. Don't be mad when you get a thank you gift that wasn't what you expected. Don't get mad at your security report not meeting guidelines.

forgottenpass 13y ago
when did everyone become so entitled to getting something for reporting a bug/security concern Sometime around the point where: - Yahoo!'s competition started offering bounties, and - "Entitlement" became a rhetorical tool to dismiss discussion of any business practice that might cost money
- elliottcarlson 13y ago
  This has nothing to do with Yahoo - this has to do with every time there is someone complaining about them not receiving the bounty they wanted - and in this case about getting a t-shirt as a thank you. I am happy Yahoo is putting a reward program in to place - but the general commentary from the community annoys me.
  - thaumaturgy 13y ago
    It's simple pragmatism. I'd expect that HN, of all places, would get this. (And most seem to.) You are a security "researcher". Maybe that means you work with a group of bona-fide professionals, maybe that means you're still in high school. Either way, you have the capability to break things. But, breaking things isn't trivial; you don't expect to spend a few minutes "poking around" and come up with something, especially something interesting. So you have some choices. You can: try to break things which will give you rewards proportional to the time you spent and the severity of what you find; try to break things which will give you almost no official reward at all; or try to break things and then sell the solution to the highest bidder or make use of it yourself. (Let's assume that people aren't generally in the habit of working for free.) Now then. You're Yahoo, with millions of user accounts and a not-great track record for security. What would you prefer for the hacker to do, and how would you incentivize them to do it? You can gripe about "the community" or "entitlement" all you want -- until it becomes sufficiently annoying or unproductive -- but that won't change the end result, which is that companies which give substantial rewards for bug bounties are creating a marketplace where they win by getting lots of good talent to examine their systems without paying by the hour or day for it and the company gets first dibs on the details of the bug. Companies which don't do this, lose.
    - drharris 13y ago
      > Companies which don't do this, lose. People lose. As in, real flesh and blood people. Everyone seems to think, "Ah, they'll just sell it to the highest bidder." You know what, screw that belief, and screw those people who think that way. You do that, you become evil. End of story. Should it be the company's job to ensure this doesn't happen as best as possible? Yes. Does the lack of a reward justify the demonstrably evil behavior of selling vulnerabilities? No. Sick and tired of the idea it's ok to sell a vulnerability wherever the money is. When is the computing community going to step up and put an end to morally wrong behavior like this? We need to ostracize those people, not condone and justify such behavior.
      - zem 13y ago
        it's a bit more complicated than that, though - it's not that the same people who would have found and reported vulnerabilities to yahoo if they were properly incentivised will instead turn around and sell them to the highest bidder. the black-hats will always get a higher reward from other criminals than they will from the companies; the point is that if you can also get a white-hat to report stuff to you, you can perhaps fix it before the criminals exploit it. in the absence of incentives, the danger is that the white-hats will simply not bother with you. and yes, people lose, but you cannot really lay a moral responsibility on people to help a profit-making company out for free just because if they don't other people might get hurt.
      - shawn-furyan 13y ago
        I agree. I think the problem is conflating the dark grey market[1] values of vulnerabilities with their white market values. Reportedly there is a lot of money in the security vulnerability dark grey market at this particular moment in time, and that seems to be pushing up the perceived monetary value of these vulnerabilities. But if you think about it, it would feel an awful lot like extortion for a researcher who's found a vulnerability to allude to the grey market value of a vulnerability in a responsible disclosure discussion. This is kind of what the community is doing by consistently bringing that point up in regards to rewards for such responsible disclosures. At the end of the day, if the researcher is virtuous, then the black/grey market value of the vulnerability is irrelevant, and so acknowledgement of the issue, followed by rapid action to close the vulnerability, and optionally, a token of appreciation is plenty of reward for the disclosure from a moral point of view. Now, I'm not naive. I believe that people respond to incentives and when you're talking about incentives, then the black/grey market values do come into the calculation. But that's a purely amoral and pragmatic optimization problem, and therefore not a proper object for the moralizing that we've seen regarding these programs. I don't have any particular issues with pontificating about how a particular company could be more effective if it increased its bug bounty rates[2], but any pseudo-moral outrage is hollow because it's founded on the assumption that moral and immoral disclosure are relatively equivalent options. [1] That is, it's not always technically illegal, but I think that the market is fairly universally regarded as antisocial if not a major threat of the day. [2] Though it would be very difficult for a company outsider to actually accurately determine the value of responsible disclosures to a company. There are a whole lot of vulnerabilities in complex software, and really, any particular disclosure is essentially worthless. I would imagine that the real monetary value of a given disclosure is orders of magnitude less valuable to the vulnerable company than it would be to a potential attacker. For the vulnerable company, they still have a vulnerable product after fixing the particular vulnerability, but for the attacker, they have a successful attack vector by having knowledge of the particular open vulnerability. Also, I can't imagine that the value of a particular vulnerability is proportional to the company's revenue/valuation/etc. which is the metric that seems to always be trotted out when talking about how a particular company's reward program is not generous enough, especially with regards to "billion dollar companies"
- nodata 13y ago
  and to ensure the bug gets to the vendor and isn't sold elsewhere.
  - ramses0 13y ago
    Isn't that ransom / hostage-taking?
    - Xorlev 13y ago
      It's business.
    - PeterisP 13y ago
      Ransom / hostage-taking is when you take something that doesn't belong to you. This action is taking something that you created (important, unique data) and offering it for auction instead of gifting it to the place where it would benefit everyone.
      - ars_technician 13y ago
        Similar to finding nudes of your neighbor laying in their driveway. Sure, you could let them know and hope for a reward, or you could put it up for auction, which is totally not exploitative. /s
        PeterisP 13y ago
        Yahoo is neither my neighbor, peer or equal. There are very different social expectations when doing 'business' with your neighbor versus doing business with a corporate entity. Also, losing photos is a very different than distributing a partly defective product - you're generally not morally at fault for accidentally losing your own stuff, but you are fully responsible for accidentally manufacturing and distributing defective products. An appropriate non-IT analogy would be noticing a particular simple way how a Bigcorp chainsaw could be made safer, fixing a risk of hurting the user - you could just let them know "hey, do X and all your chainsaws will be safer for all of us" and get nice fuzzies, or offer to sell them (or other chainsaw manufacturers) the discovery - it's your choice, and although one is much more charitable, both choices are acceptable.
- tesseractive 13y ago
  Serious question: I'm familiar with bounties for browsers and OSs, but do most websites offer bug bounties now?
  - arkem 13y ago
    Many websites do but I wouldn't say most. Bugcrowd maintains a list of websites that have bounty programs: https://bugcrowd.com/list-of-bug-bounty-programs/ https://bugcrowd.com/list-of-bug-bounty-programs/
yogo 13y ago
I don't think it is entitlement. We live in a value for value world. Bringing to light a problem that can cost the company millions of dollars is worth something. No one was bitching (at least not loudly) about Yahoo not having a bounty program, the reaction was that if they only want to shell out $15 then they're cheap (not recognizing value).
- eli 13y ago
  Sorry, but I don't get this mindset. It would have been better to give them nothing rather than a "cheap" gift? If you want to get paid market rate for the value you provide as a security researcher, then stop doing work on spec and just hoping that someone compensates you for it.
  - bryanlarsen 13y ago
    "Sorry, but I don't get this mindset. It would have been better to give them nothing rather than a "cheap" gift?" Standard practice to deliberately insult a waitress is to leave a short tip. That's more insulting than leaving nothing.
    - zequel 13y ago
      Probably related to the fact that the waitress can justify no tip with the thought "they might have forgotten to leave one". A short tip sends a message.
    - nmcfarl 13y ago
      Which is a good point - as it gives illustration to mikeash's point in this same thread. This doesn’t make logical sense at all - but there are practices based on it. And in this case both the "a token of our appreciation" and "short tip" practices could been "meant", and were as a matter of fact taken as "meant" by the sender and receiver respectively.
    - Suitov 13y ago
      Oh hell, is it? Quite often I'm short on cash and just tip with the change I have - not tiny-denomination coins, I hasten to add, but 50ps/£1s. Bugger.
asmithmd1 13y ago
Money is how we keep score and literally show each other what we value. I think there is a threshold amount that demonstrates that they really care and I would define that as enough money for a date. I found a vulnerability with a large regional service I use a couple of years ago and did the right thing by discreetly reporting it. They thanked me and gave me credit for their service equal to about $50; I felt like they really appreciated my report. If they had given me swag they give away for free I would have been nonplussed.
- PhasmaFelis 13y ago
  If you report a bug to a company that has no posted bug-bounty policy, you really shouldn't be expecting anything but a "thank you". If you don't get a thank you, then you have a right to be nonplussed. Anything beyond a thank you (cash, T-shirts, warm hugs) is pure gravy and, IMHO, ought to be appreciated as such. That said, yes, big companies really ought to have official bug bounties. But that doesn't mean you have a right to expect them.
robin_reala 13y ago
There’s a market rate for vulnerabilities in highly trafficked websites. If you want people to give you the bug report instead of selling it to zero-day gangs or governments then you need to pay the market rate. You can expect a small discount because selling the bug to you is ‘doing the right thing’, but if you’re not paying more than a tee and you want to attract the people that go out of their way to discover issues then you’re automatically on the back foot.
- spullara 13y ago
  Roughly similar to a guy that walks through your neighborhood jiggling door knobs and asks for $100/house when he discovers an unlocked door or disabled alarm system otherwise he will report it to his burglar friends.
  - csmatt 13y ago
    Not at all similar to that. Ignoring the fact that the characteristics of residences and a very high traffic website with an enormous user-base are vastly different, your argument relies on the discoverer of the vulnerability choosing one of two paths: get paid by the company or get paid by nefarious people. A third option is to choose neither because the discoverer doesn't think it warrants his or her time to report it. Reporting a security vulnerability requires more than just sending an email. Meanwhile, others who have discovered the same vulnerability may be selling access to it and a company like Yahoo has no idea until severe damage has been done.
    - spullara 13y ago
      Assuming they spent effort to discover the vulnerability the idea that there is a 3rd option where it is suddenly not worth their time to report it makes little sense.
masklinn 13y ago
> when did everyone become so entitled to getting something for reporting a bug/security concern. Somewhere between the ability to sell vulnerabilities and the implementation of bug bounties.
kozhevnikov 13y ago
Agree, but how would you feel if you got an Addison-Wesley t-shirt instead of a check for $2.56? http://en.wikipedia.org/wiki/Knuth_reward_check http://en.wikipedia.org/wiki/Knuth_reward_check
- oijaf888 13y ago
  You did read that right? Knuth doesn't send real checks anymore due to check fraud. So the actual thing you get is comparable to a t-shirt (admittedly a very limited edition t-shirt).
  - kozhevnikov 13y ago
    I did. The question was 'when did everyone become so entitled to getting something for reporting a bug' to which I provided a valid (or at least humorous) possible answer, i.e. since Knuth's reward checks became a status symbol.
leke 13y ago
You're absolutely right. That's why I would never use Yahoo for anything important of mine. Having such an incentive in place is a crucial measure in today's security climate.
- elliottcarlson 13y ago
  Great - so do you use Github? Because if you do, then you are obviously putting your important files at risk.
jessaustin 13y ago
...I technically work for Yahoo... Why on earth are you undermining Yahoo's official communications in a public forum?
- elliottcarlson 13y ago
  The opinion stated is with the general mentality around bug rewards. In what way was it undermining Yahoo?
  - jessaustin 13y ago
    You say, "go directly to the companies that actually have a reward program in place" while Ramses says, "when you work for a company that serves more than 800 million people every month, you take network and user security very seriously." Ramses would probably prefer you not to discourage vulnerability reporting in the way that you have. But more importantly, his tone is entirely different. He doesn't mention the term "entitled" once, and he doesn't imply that the original report was somehow deficient.
    - elliottcarlson 13y ago
      I said "If you are looking to make a living off of finding bugs, go directly to the companies that actually have a reward program in place." which is a little different. I encourage reporting bugs at any capacity. If your motives are aligned differently, then why would someone get mad at not receiving what they think they should be getting? My tone is different because I am expressing my opinion on how there seems to be a sense of entitlement out there lately - at least that is how I perceive it. I don't want to discourage the reporting aspect, I want to discourage the way people are behaving when their bug report doesn't meet certain standards, or where even a thank you rubs them the wrong way.
- dangrossman 13y ago
  Because taking a job with Yahoo! did not involve signing away his rights to his own opinions, or the ability to discuss them with others without hiding his employment relationship. Which is a good thing.
javajosh 13y ago
>when did everyone become so entitled to getting something for reporting a bug/security concern. When did everyone stop reflecting on how communication can be improved? Yahoo! wants to better show it's appreciation and gratitude for these security finds. Security researchers don't want their work cheapened.
EnderMB 13y ago
I've submitted a number of bugs to different tools and sites, and in the vast majority of cases the company involved have promptly got back to me, have thanked me for my time, and have informed me of the status of the bug. In the rare instances where my report is ignored, and any attempts to report to a developer (easily found on Twitter) are ignored, I tend to just forget about it. I assume that it gets read, and that eventually it gets fixed. That being said, when you've found a software bug, especially a large bug, the teams treatment of the bug reflects your opinion of the entire company. I noticed that one large website was pushing new registered passwords around in plain text, and I reported this. Six months later, the bug still exists. My opinion of the holding company (which runs a number of popular sites) has dropped significantly. I think most developers are just happy to be thanked, and are hopeful that their report will be taken seriously and fixed as a priority. Gifts are nice, but a fixed bug and a genuine thanks from a real person at that company are much better.
markolschesky 13y ago
I don't think it's about entitlement. Twilio, either formally or informally, sent me a t-shirt twice when I found a bug. For me as a programmer, a bug on the 3rd party partner side generally means I spent some amount of my time figuring out that the bug wasn't something I was generating, but rather my vendor. Programmer time has a pretty real value to it, which no one likes wasting. When I reported the bug and the support person offered to send me a t-shirt, I forgot about the time I spent on the bug and went "Neat! A t-shirt!". Now, when I look at the t-shirt, I couldn't tell you the specifics on the troubleshooting or how it ruined my afternoon 10 months ago. But, I can tell you that it felt like the vendor actually responded to my concerns. Some vendors haven't, and then I do the natural thing and spew vitriol about them across the internet and to my colleagues. If I didn't like a vendor and they were replaceable, the second that I hit a bug that I felt the need to report, I would just not use that vendor anymore. Anyone who files a bug report has some amount of loyalty to a company that is not worth upsetting.
wpietri 13y ago
It's not that I disagree with your opinion; if I found a bug and I reported, all I'd really want to know is that they were taking it seriously. So a personal note would be great. And I love that this guy was, in the midst of dysfunction, just buying the t-shirts and sending them out because it was The Right Thing. However, it is a little much for a for-profit, publicly traded company with $4 billion in annual revenue (mostly made from manipulating how their users spend money) to think that other people should do things for them for free. I certainly miss the long-ago days when the Internet was an academic community, mainly free of commercial influence. And I love it when people rise above base commercial motives to do something more beautiful. But if we line people up based on their right to complain that the Internet is all crass and money-oriented these days, Yahoo, who led the first wave of Internet commercialization, surely must be near the back.
- dopamean 13y ago
  > However, it is a little much for a for-profit, publicly traded company with $4 billion in annual revenue (mostly made from manipulating how their users spend money) to think that other people should do things for them for free. I'm not sure I understand this. Yahoo! did not have a bounty program that paid out money so if you were submitting a vulnerability you found it would be a little ridiculous to expect any remuneration.
  - wpietri 13y ago
    My point here is that a for-profit company shouldn't expect random people to do nice things for free. Sometimes they do and that's great. But they shouldn't expect it. The post I was replying to comes from a "let's all help each other out" perspective, which I like and is the mode I want everybody to be in. But the last people who should be pushing that line are those who are making billions of dollars. Especially so when those people are the ones who led the first wave of commercializing the internet. It comes across to me as something like, "Hey, let's all work together so I can line my pockets."
    - ars_technician 13y ago
vinceguidry 13y ago
Paying bounties in this way is in my mind comparable to tipping in restaurants. It's a compromise that doesn't really solve the stated problem, but it's adequate enough to allow business to move forward until the status-quo evolves. Ideally in a restaurant, we'd pay servers real wages. Well the market won't bear that. So we have this tipping system set up. It's by no means ideal, but it works well enough and eventually, tipless restaurants will bowl everyone over with how much better they are and we'll just move in that direction. Security research needs to be paid. There's too much on the line to just leave this work to unpaid volunteers. But a real security department, for many reasons, is simply unfeasible. Real security has to audit everything. Too much manpower is needed. Bug bounties allow websites to get the security updates they need while compensating researchers somewhat adequately. It's not entitlement to believe that you should get an appropriate payment for your research. These companies have a responsibility to their customers. They all need to be paying bounties. Even the ones that have security departments should be paying them because people miss things all the time and the consequences of a breach are tremendous. Better pay a little now to avoid a lot of pain later.
guyzero 13y ago
It's not so much entitlement as that there is a real and active marketplace for security vulnerabilities. If Yahoo isn't going to pay, someone else is going to pay for vulnerabilities and that would be a lot worse.
kefka 13y ago
I look at getting paid for bugs from the other side as well. The company can offer X dollars for a bug. Cool. So, you're buying my time. Or I can take this bug to an Onion site and auction this bug off to the highest paying blackhat. It would most likely bed used for illegal purposes, but selling bugs isn't illegal if found accidentally. What I'm saying is this is Capitalism in action.
tytso 13y ago
>Great on Yahoo for putting a reward program in place, but when did everyone become so entitled to getting something for reporting a bug/security concern. For better or for worse, cyber criminals started paying black hats for exclusive access to vulnerabilities, and now "good guys" such as the NSA and the FBI are paying grey hats for exclusive access to vulnerabilities. At this point, if you are a security researcher, if you voluntarily disclose a vulnerability you find to a company like Yahoo or Microsoft, even with the fairly generous rewards getting paid out, it's likely they will be taking a monetary hit compared to what an organization like the NSA would be willing to pay. Fortunately, there are still people who have enough of a conscience that they still care about doing the right thing, as opposed to optimizing for their monetary return (and if you are selling to the government agency like the NSA, you are automatically on the side of the angels, right?). But if you are looking for someone to blame, I'd nominate organizations like the NSA and the cyber-criminals. That's not particularly constructive, though --- the world is the way it is now, and it's unlikely to be something that can be changed back to the "Good Old Days" (which, for the record, was never really all that Good).
teh_klev 13y ago
I generally agree with this. It's trying to make a living off of handing in lost wallets or purses full of money then expecting a cut just for doing what any civilised person should do. Personally, I'm happy with a thank you, a t-shirt would have been a bonus.

forgottenpass 13y ago

when did everyone become so entitled to getting something for reporting a bug/security concern Sometime around the point where: - Yahoo!'s competition started offering bounties, and - "Entitlement" became a rhetorical tool to dismiss discussion of any business practice that might cost money

elliottcarlson 13y ago
This has nothing to do with Yahoo - this has to do with every time there is someone complaining about them not receiving the bounty they wanted - and in this case about getting a t-shirt as a thank you. I am happy Yahoo is putting a reward program in to place - but the general commentary from the community annoys me.
- thaumaturgy 13y ago
  It's simple pragmatism. I'd expect that HN, of all places, would get this. (And most seem to.) You are a security "researcher". Maybe that means you work with a group of bona-fide professionals, maybe that means you're still in high school. Either way, you have the capability to break things. But, breaking things isn't trivial; you don't expect to spend a few minutes "poking around" and come up with something, especially something interesting. So you have some choices. You can: try to break things which will give you rewards proportional to the time you spent and the severity of what you find; try to break things which will give you almost no official reward at all; or try to break things and then sell the solution to the highest bidder or make use of it yourself. (Let's assume that people aren't generally in the habit of working for free.) Now then. You're Yahoo, with millions of user accounts and a not-great track record for security. What would you prefer for the hacker to do, and how would you incentivize them to do it? You can gripe about "the community" or "entitlement" all you want -- until it becomes sufficiently annoying or unproductive -- but that won't change the end result, which is that companies which give substantial rewards for bug bounties are creating a marketplace where they win by getting lots of good talent to examine their systems without paying by the hour or day for it and the company gets first dibs on the details of the bug. Companies which don't do this, lose.
  - drharris 13y ago
    > Companies which don't do this, lose. People lose. As in, real flesh and blood people. Everyone seems to think, "Ah, they'll just sell it to the highest bidder." You know what, screw that belief, and screw those people who think that way. You do that, you become evil. End of story. Should it be the company's job to ensure this doesn't happen as best as possible? Yes. Does the lack of a reward justify the demonstrably evil behavior of selling vulnerabilities? No. Sick and tired of the idea it's ok to sell a vulnerability wherever the money is. When is the computing community going to step up and put an end to morally wrong behavior like this? We need to ostracize those people, not condone and justify such behavior.
    - zem 13y ago
      it's a bit more complicated than that, though - it's not that the same people who would have found and reported vulnerabilities to yahoo if they were properly incentivised will instead turn around and sell them to the highest bidder. the black-hats will always get a higher reward from other criminals than they will from the companies; the point is that if you can also get a white-hat to report stuff to you, you can perhaps fix it before the criminals exploit it. in the absence of incentives, the danger is that the white-hats will simply not bother with you. and yes, people lose, but you cannot really lay a moral responsibility on people to help a profit-making company out for free just because if they don't other people might get hurt.
    - shawn-furyan 13y ago
      I agree. I think the problem is conflating the dark grey market[1] values of vulnerabilities with their white market values. Reportedly there is a lot of money in the security vulnerability dark grey market at this particular moment in time, and that seems to be pushing up the perceived monetary value of these vulnerabilities. But if you think about it, it would feel an awful lot like extortion for a researcher who's found a vulnerability to allude to the grey market value of a vulnerability in a responsible disclosure discussion. This is kind of what the community is doing by consistently bringing that point up in regards to rewards for such responsible disclosures. At the end of the day, if the researcher is virtuous, then the black/grey market value of the vulnerability is irrelevant, and so acknowledgement of the issue, followed by rapid action to close the vulnerability, and optionally, a token of appreciation is plenty of reward for the disclosure from a moral point of view. Now, I'm not naive. I believe that people respond to incentives and when you're talking about incentives, then the black/grey market values do come into the calculation. But that's a purely amoral and pragmatic optimization problem, and therefore not a proper object for the moralizing that we've seen regarding these programs. I don't have any particular issues with pontificating about how a particular company could be more effective if it increased its bug bounty rates[2], but any pseudo-moral outrage is hollow because it's founded on the assumption that moral and immoral disclosure are relatively equivalent options. [1] That is, it's not always technically illegal, but I think that the market is fairly universally regarded as antisocial if not a major threat of the day. [2] Though it would be very difficult for a company outsider to actually accurately determine the value of responsible disclosures to a company. There are a whole lot of vulnerabilities in complex software, and really, any particular disclosure is essentially worthless. I would imagine that the real monetary value of a given disclosure is orders of magnitude less valuable to the vulnerable company than it would be to a potential attacker. For the vulnerable company, they still have a vulnerable product after fixing the particular vulnerability, but for the attacker, they have a successful attack vector by having knowledge of the particular open vulnerability. Also, I can't imagine that the value of a particular vulnerability is proportional to the company's revenue/valuation/etc. which is the metric that seems to always be trotted out when talking about how a particular company's reward program is not generous enough, especially with regards to "billion dollar companies"
nodata 13y ago
and to ensure the bug gets to the vendor and isn't sold elsewhere.
- ramses0 13y ago
  Isn't that ransom / hostage-taking?
  - Xorlev 13y ago
    It's business.
  - PeterisP 13y ago
    Ransom / hostage-taking is when you take something that doesn't belong to you. This action is taking something that you created (important, unique data) and offering it for auction instead of gifting it to the place where it would benefit everyone.
    - ars_technician 13y ago
      Similar to finding nudes of your neighbor laying in their driveway. Sure, you could let them know and hope for a reward, or you could put it up for auction, which is totally not exploitative. /s
      - PeterisP 13y ago
        Yahoo is neither my neighbor, peer or equal. There are very different social expectations when doing 'business' with your neighbor versus doing business with a corporate entity. Also, losing photos is a very different than distributing a partly defective product - you're generally not morally at fault for accidentally losing your own stuff, but you are fully responsible for accidentally manufacturing and distributing defective products. An appropriate non-IT analogy would be noticing a particular simple way how a Bigcorp chainsaw could be made safer, fixing a risk of hurting the user - you could just let them know "hey, do X and all your chainsaws will be safer for all of us" and get nice fuzzies, or offer to sell them (or other chainsaw manufacturers) the discovery - it's your choice, and although one is much more charitable, both choices are acceptable.
tesseractive 13y ago
Serious question: I'm familiar with bounties for browsers and OSs, but do most websites offer bug bounties now?
- arkem 13y ago
  Many websites do but I wouldn't say most. Bugcrowd maintains a list of websites that have bounty programs: https://bugcrowd.com/list-of-bug-bounty-programs/ https://bugcrowd.com/list-of-bug-bounty-programs/

yogo 13y ago

I don't think it is entitlement. We live in a value for value world. Bringing to light a problem that can cost the company millions of dollars is worth something. No one was bitching (at least not loudly) about Yahoo not having a bounty program, the reaction was that if they only want to shell out $15 then they're cheap (not recognizing value).

eli 13y ago
Sorry, but I don't get this mindset. It would have been better to give them nothing rather than a "cheap" gift? If you want to get paid market rate for the value you provide as a security researcher, then stop doing work on spec and just hoping that someone compensates you for it.
- bryanlarsen 13y ago
  "Sorry, but I don't get this mindset. It would have been better to give them nothing rather than a "cheap" gift?" Standard practice to deliberately insult a waitress is to leave a short tip. That's more insulting than leaving nothing.
  - zequel 13y ago
    Probably related to the fact that the waitress can justify no tip with the thought "they might have forgotten to leave one". A short tip sends a message.
  - nmcfarl 13y ago
    Which is a good point - as it gives illustration to mikeash's point in this same thread. This doesn’t make logical sense at all - but there are practices based on it. And in this case both the "a token of our appreciation" and "short tip" practices could been "meant", and were as a matter of fact taken as "meant" by the sender and receiver respectively.
  - Suitov 13y ago
    Oh hell, is it? Quite often I'm short on cash and just tip with the change I have - not tiny-denomination coins, I hasten to add, but 50ps/£1s. Bugger.

asmithmd1 13y ago

Money is how we keep score and literally show each other what we value. I think there is a threshold amount that demonstrates that they really care and I would define that as enough money for a date. I found a vulnerability with a large regional service I use a couple of years ago and did the right thing by discreetly reporting it. They thanked me and gave me credit for their service equal to about $50; I felt like they really appreciated my report. If they had given me swag they give away for free I would have been nonplussed.

PhasmaFelis 13y ago
If you report a bug to a company that has no posted bug-bounty policy, you really shouldn't be expecting anything but a "thank you". If you don't get a thank you, then you have a right to be nonplussed. Anything beyond a thank you (cash, T-shirts, warm hugs) is pure gravy and, IMHO, ought to be appreciated as such. That said, yes, big companies really ought to have official bug bounties. But that doesn't mean you have a right to expect them.

robin_reala 13y ago

There’s a market rate for vulnerabilities in highly trafficked websites. If you want people to give you the bug report instead of selling it to zero-day gangs or governments then you need to pay the market rate. You can expect a small discount because selling the bug to you is ‘doing the right thing’, but if you’re not paying more than a tee and you want to attract the people that go out of their way to discover issues then you’re automatically on the back foot.

spullara 13y ago
Roughly similar to a guy that walks through your neighborhood jiggling door knobs and asks for $100/house when he discovers an unlocked door or disabled alarm system otherwise he will report it to his burglar friends.
- csmatt 13y ago
  Not at all similar to that. Ignoring the fact that the characteristics of residences and a very high traffic website with an enormous user-base are vastly different, your argument relies on the discoverer of the vulnerability choosing one of two paths: get paid by the company or get paid by nefarious people. A third option is to choose neither because the discoverer doesn't think it warrants his or her time to report it. Reporting a security vulnerability requires more than just sending an email. Meanwhile, others who have discovered the same vulnerability may be selling access to it and a company like Yahoo has no idea until severe damage has been done.
  - spullara 13y ago
    Assuming they spent effort to discover the vulnerability the idea that there is a 3rd option where it is suddenly not worth their time to report it makes little sense.

masklinn 13y ago

> when did everyone become so entitled to getting something for reporting a bug/security concern. Somewhere between the ability to sell vulnerabilities and the implementation of bug bounties.

kozhevnikov 13y ago

Agree, but how would you feel if you got an Addison-Wesley t-shirt instead of a check for $2.56? http://en.wikipedia.org/wiki/Knuth_reward_check http://en.wikipedia.org/wiki/Knuth_reward_check

oijaf888 13y ago
You did read that right? Knuth doesn't send real checks anymore due to check fraud. So the actual thing you get is comparable to a t-shirt (admittedly a very limited edition t-shirt).
- kozhevnikov 13y ago
  I did. The question was 'when did everyone become so entitled to getting something for reporting a bug' to which I provided a valid (or at least humorous) possible answer, i.e. since Knuth's reward checks became a status symbol.

leke 13y ago

You're absolutely right. That's why I would never use Yahoo for anything important of mine. Having such an incentive in place is a crucial measure in today's security climate.

elliottcarlson 13y ago
Great - so do you use Github? Because if you do, then you are obviously putting your important files at risk.

jessaustin 13y ago

...I technically work for Yahoo... Why on earth are you undermining Yahoo's official communications in a public forum?

elliottcarlson 13y ago
The opinion stated is with the general mentality around bug rewards. In what way was it undermining Yahoo?
- jessaustin 13y ago
  You say, "go directly to the companies that actually have a reward program in place" while Ramses says, "when you work for a company that serves more than 800 million people every month, you take network and user security very seriously." Ramses would probably prefer you not to discourage vulnerability reporting in the way that you have. But more importantly, his tone is entirely different. He doesn't mention the term "entitled" once, and he doesn't imply that the original report was somehow deficient.
  - elliottcarlson 13y ago
    I said "If you are looking to make a living off of finding bugs, go directly to the companies that actually have a reward program in place." which is a little different. I encourage reporting bugs at any capacity. If your motives are aligned differently, then why would someone get mad at not receiving what they think they should be getting? My tone is different because I am expressing my opinion on how there seems to be a sense of entitlement out there lately - at least that is how I perceive it. I don't want to discourage the reporting aspect, I want to discourage the way people are behaving when their bug report doesn't meet certain standards, or where even a thank you rubs them the wrong way.
dangrossman 13y ago
Because taking a job with Yahoo! did not involve signing away his rights to his own opinions, or the ability to discuss them with others without hiding his employment relationship. Which is a good thing.

javajosh 13y ago

>when did everyone become so entitled to getting something for reporting a bug/security concern. When did everyone stop reflecting on how communication can be improved? Yahoo! wants to better show it's appreciation and gratitude for these security finds. Security researchers don't want their work cheapened.

EnderMB 13y ago

I've submitted a number of bugs to different tools and sites, and in the vast majority of cases the company involved have promptly got back to me, have thanked me for my time, and have informed me of the status of the bug. In the rare instances where my report is ignored, and any attempts to report to a developer (easily found on Twitter) are ignored, I tend to just forget about it. I assume that it gets read, and that eventually it gets fixed. That being said, when you've found a software bug, especially a large bug, the teams treatment of the bug reflects your opinion of the entire company. I noticed that one large website was pushing new registered passwords around in plain text, and I reported this. Six months later, the bug still exists. My opinion of the holding company (which runs a number of popular sites) has dropped significantly. I think most developers are just happy to be thanked, and are hopeful that their report will be taken seriously and fixed as a priority. Gifts are nice, but a fixed bug and a genuine thanks from a real person at that company are much better.

markolschesky 13y ago

I don't think it's about entitlement. Twilio, either formally or informally, sent me a t-shirt twice when I found a bug. For me as a programmer, a bug on the 3rd party partner side generally means I spent some amount of my time figuring out that the bug wasn't something I was generating, but rather my vendor. Programmer time has a pretty real value to it, which no one likes wasting. When I reported the bug and the support person offered to send me a t-shirt, I forgot about the time I spent on the bug and went "Neat! A t-shirt!". Now, when I look at the t-shirt, I couldn't tell you the specifics on the troubleshooting or how it ruined my afternoon 10 months ago. But, I can tell you that it felt like the vendor actually responded to my concerns. Some vendors haven't, and then I do the natural thing and spew vitriol about them across the internet and to my colleagues. If I didn't like a vendor and they were replaceable, the second that I hit a bug that I felt the need to report, I would just not use that vendor anymore. Anyone who files a bug report has some amount of loyalty to a company that is not worth upsetting.

wpietri 13y ago

It's not that I disagree with your opinion; if I found a bug and I reported, all I'd really want to know is that they were taking it seriously. So a personal note would be great. And I love that this guy was, in the midst of dysfunction, just buying the t-shirts and sending them out because it was The Right Thing. However, it is a little much for a for-profit, publicly traded company with $4 billion in annual revenue (mostly made from manipulating how their users spend money) to think that other people should do things for them for free. I certainly miss the long-ago days when the Internet was an academic community, mainly free of commercial influence. And I love it when people rise above base commercial motives to do something more beautiful. But if we line people up based on their right to complain that the Internet is all crass and money-oriented these days, Yahoo, who led the first wave of Internet commercialization, surely must be near the back.

dopamean 13y ago
> However, it is a little much for a for-profit, publicly traded company with $4 billion in annual revenue (mostly made from manipulating how their users spend money) to think that other people should do things for them for free. I'm not sure I understand this. Yahoo! did not have a bounty program that paid out money so if you were submitting a vulnerability you found it would be a little ridiculous to expect any remuneration.
- wpietri 13y ago
  My point here is that a for-profit company shouldn't expect random people to do nice things for free. Sometimes they do and that's great. But they shouldn't expect it. The post I was replying to comes from a "let's all help each other out" perspective, which I like and is the mode I want everybody to be in. But the last people who should be pushing that line are those who are making billions of dollars. Especially so when those people are the ones who led the first wave of commercializing the internet. It comes across to me as something like, "Hey, let's all work together so I can line my pockets."
  - ars_technician 13y ago

vinceguidry 13y ago

Paying bounties in this way is in my mind comparable to tipping in restaurants. It's a compromise that doesn't really solve the stated problem, but it's adequate enough to allow business to move forward until the status-quo evolves. Ideally in a restaurant, we'd pay servers real wages. Well the market won't bear that. So we have this tipping system set up. It's by no means ideal, but it works well enough and eventually, tipless restaurants will bowl everyone over with how much better they are and we'll just move in that direction. Security research needs to be paid. There's too much on the line to just leave this work to unpaid volunteers. But a real security department, for many reasons, is simply unfeasible. Real security has to audit everything. Too much manpower is needed. Bug bounties allow websites to get the security updates they need while compensating researchers somewhat adequately. It's not entitlement to believe that you should get an appropriate payment for your research. These companies have a responsibility to their customers. They all need to be paying bounties. Even the ones that have security departments should be paying them because people miss things all the time and the consequences of a breach are tremendous. Better pay a little now to avoid a lot of pain later.

guyzero 13y ago

It's not so much entitlement as that there is a real and active marketplace for security vulnerabilities. If Yahoo isn't going to pay, someone else is going to pay for vulnerabilities and that would be a lot worse.

kefka 13y ago

I look at getting paid for bugs from the other side as well. The company can offer X dollars for a bug. Cool. So, you're buying my time. Or I can take this bug to an Onion site and auction this bug off to the highest paying blackhat. It would most likely bed used for illegal purposes, but selling bugs isn't illegal if found accidentally. What I'm saying is this is Capitalism in action.

tytso 13y ago

>Great on Yahoo for putting a reward program in place, but when did everyone become so entitled to getting something for reporting a bug/security concern. For better or for worse, cyber criminals started paying black hats for exclusive access to vulnerabilities, and now "good guys" such as the NSA and the FBI are paying grey hats for exclusive access to vulnerabilities. At this point, if you are a security researcher, if you voluntarily disclose a vulnerability you find to a company like Yahoo or Microsoft, even with the fairly generous rewards getting paid out, it's likely they will be taking a monetary hit compared to what an organization like the NSA would be willing to pay. Fortunately, there are still people who have enough of a conscience that they still care about doing the right thing, as opposed to optimizing for their monetary return (and if you are selling to the government agency like the NSA, you are automatically on the side of the angels, right?). But if you are looking for someone to blame, I'd nominate organizations like the NSA and the cyber-criminals. That's not particularly constructive, though --- the world is the way it is now, and it's unlikely to be something that can be changed back to the "Good Old Days" (which, for the record, was never really all that Good).

teh_klev 13y ago

I generally agree with this. It's trying to make a living off of handing in lost wallets or purses full of money then expecting a cut just for doing what any civilised person should do. Personally, I'm happy with a thank you, a t-shirt would have been a bonus.