5 ms·

I don't think it is entitlement. We live in a value for value world. Bringing to light a problem that can cost the company millions of dollars is worth somethin

by yogo 13y ago

I don't think it is entitlement. We live in a value for value world. Bringing to light a problem that can cost the company millions of dollars is worth something. No one was bitching (at least not loudly) about Yahoo not having a bounty program, the reaction was that if they only want to shell out $15 then they're cheap (not recognizing value).

eli 13y ago
Sorry, but I don't get this mindset. It would have been better to give them nothing rather than a "cheap" gift? If you want to get paid market rate for the value you provide as a security researcher, then stop doing work on spec and just hoping that someone compensates you for it.
- bryanlarsen 13y ago
  "Sorry, but I don't get this mindset. It would have been better to give them nothing rather than a "cheap" gift?" Standard practice to deliberately insult a waitress is to leave a short tip. That's more insulting than leaving nothing.
  - zequel 13y ago
    Probably related to the fact that the waitress can justify no tip with the thought "they might have forgotten to leave one". A short tip sends a message.
  - nmcfarl 13y ago
    Which is a good point - as it gives illustration to mikeash's point in this same thread. This doesn’t make logical sense at all - but there are practices based on it. And in this case both the "a token of our appreciation" and "short tip" practices could been "meant", and were as a matter of fact taken as "meant" by the sender and receiver respectively.
  - Suitov 13y ago
    Oh hell, is it? Quite often I'm short on cash and just tip with the change I have - not tiny-denomination coins, I hasten to add, but 50ps/£1s. Bugger.
- yogo 13y ago
  Yahoo is free to do whatever they want. I think that's obvious. My opinion from the sidelines reflects what I think it looks like. Certain things become the norm, for e.g. someone finds $100K and returns it, the norm is to pay them a nice reward for doing so. There is absolutely no agreement or law in place that says they have to get anything in return. In fact, neither I nor most people I know expect anything in return for doing the right thing. What would your reaction be if the finder received nothing? Just in case you want to know where I stand: if I find $100K in cash and there is no way to trace it back to me I'm not returning it. However, that is different to finding a bug and selling it for monetary gain.
- mikeash 13y ago
  > It would have been better to give them nothing rather than a "cheap" gift? YES! There seem to be two camps here, neither of which can even fathom the other's position. On your side, we have people who do a purely logical comparison that non-zero is greater than zero, so this is better. On my side, we have people who inherently separate tasks done for free for fun or just to be nice, from tasks done for money. For these people, getting paid a pittance is a grave insult, while not getting paid at all (when nothing is owed) is just fine. I don't really know how to explain it any further. I think the people in your camp just need to understand that the other camp exists and contains a lot of people, and that regardless of logic, giving someone a $12.50 gift card is a massive insult, far worse than giving them nothing. You don't have to understand why, but you have to know that this is how it is for a lot of people.
  - yogo 13y ago
    I wish a sociologist or anthropologist would comment and explain formally what this is but I'm thinking it is something along the lines of a thank you or appreciation not being quantifiable. Where as putting money (or something quantifiable) on the table communicates some sort of value.
    - mikeash 13y ago
      Yeah, I'd like a better explanation myself. I feel it, but I can't really explain why. It seems like there are just two distinct modes. When you do something for free, you're basically doing a favor, and you get pleasure from being altruistic. Once you get paid, it's now an exchange of value, not altruism, so you only get pleasure from being paid. If the pay is small, you'll feel upset because your end of the bargain is based entirely on that, while if you're doing it for free, you switch over. I could be full of it....
    - asmithmd1 13y ago
      Yahoo "owed him one" when he reported the vulerabilty. When they traded a shirt for the report Yahoo was implying that they no longer owed him anything, it was a fair barter
    - 13y ago
- ronaldx 13y ago
  > It would have been better to give them nothing rather than a "cheap" gift? Yes. Giving nothing doesn't give any indication of value - maybe the work is very highly valued but it's not Yahoo's policy to compensate. Fair enough. Giving a cheap gift attaches a very particular value. There is a body of research on this, e.g. http://ideas.repec.org/p/zur/iewwpx/007.html http://ideas.repec.org/p/zur/iewwpx/007.html "rewards undermine the intrinsic motivation of volunteers." "a large literature in social psychology [emphasizes] that external rewards can undermine the intrinsic motivation for an activity"
- kens 13y ago
  There's a big discussion of this in the book "Predictably Irrational", chapter 4: "Why we are happy to do things, but not when we are paid to do them". It explains that there are two worlds: The first is "social norms", which is community based. This is where you have friends over for dinner, help someone move a couch, and other friendly things. The other world is "market norms", where things are transaction based with something exchanged for something of equal value (normally, but not always money). The problem is when the worlds of social norms and market norms cross. The book gives the example of Thanksgiving dinner, and what would happen if you offered your mother-in-law a couple hundred dollars to pay for the meal at the end. Another example is sex: paying for sex makes it a very different situation. (Also note the difference between giving someone flowers on a date and giving someone cash.) The book describes a research experiment, where participants were paid $5, 50 cents, or nothing to perform a short task of sorting shapes. The people paid $5 sorted 50% more shapes than the people paid less (since they were more motivated), but the people paid nothing did the most of all since they were motivated by helping out the researchers. This ties in with intrinsic vs extrinsic motivation - if you're getting paid, it's extrinsic motivation, and then you're motivated by whether you're getting your money's worth. (There's a lot more, but I don't have time to get into it, so check out the book.) The point is, that if people report bugs for free, it's part of the social norms world, where they are keeping the world safe, making it a better place, etc. If they are getting paid, it's part of the market norms world, and they expect to get paid what the bug is worth. With Yahoo, the lines got crossed: giving a T-shirt is generally part of the social norms world, but giving a $12 gift certificate crosses over into the market norms world, and $12 is insultingly low. This is why it would have been better for Yahoo to give nothing.
  - DanielStraight 13y ago
    Exactly. This guy accidentally crossed into market norms by doing something that seemed completely reasonable at the time. Imagine you ask a friend over to help fix your car in exchange for beer. This would clearly not be interpreted as payment, but as a way of saying thanks. Now suppose it turns out they generally like beer but hate the particular kind you purchased, so you feel bad and give them $10 to buy themselves a beer they like. Suddenly, thinking you were doing something nice, you've crossed into market norms. This, as far as I can tell, is basically what happened.
- wpietri 13y ago
  I was once at a busy bar. The guy in front of me, his order came to $9.75. He gave the bartender $10; she gave him a quarter back as she delivered the last of his drinks. He tried to leave the $0.25 as a tip. She said, "Oh, no, you must need this," and gave it back to him. Her clear view was that no tip was better than $0.25. I congratulated her, and made up for his idiocy with my tip. If you don't tip at all, you're either clueless or an asshole. Tipping a quarter is more insulting: you're acknowledging the need to tip, but making it clear you don't think much of the bartender.
- danielweber 13y ago
  I would think he avoided the concept of paying them by giving a gift instead, which sidesteps the concept of "pay" the same way an honorarium[1] would. I was at a company where someone reported a security problem to the support team. I didn't quite believe it, but they got me on the phone, and within 10 seconds the guy had said the right words to tell me he had found something. So we fixed it. What then? The company had no formal bounty system in place. I said we should send him something, so I got him an Amazon gift card and sent it to him along with a letter of thanks. He said thank you back to us. It all seemed good, but maybe it was just luck of the draw that an Internet mob didn't show up for me the next day. [1] http://en.wikipedia.org/wiki/Honorarium http://en.wikipedia.org/wiki/Honorarium
res0nat0r 13y ago
Yet there have been dozens upon dozens of threads in this same forum of people making up all kinds of explanations of why they don't want to pay $15 for a music cd they will listen to possibly dozens of times over their lifetime. Ironic...
snarfy 13y ago
It implicitly meant they don't really value security.
- yogo 13y ago
  Exactly. When that comment came from a Yahoo employee I caught a glimpse of what I think the company's attitude towards security is. To me it seemed like there was no understanding that by not taking care of the little things that are lurking in the dark it can cost the company big time. Yes, I know this is an employee's personal opinion, but still...
  - elliottcarlson 13y ago
    Kind of an unfair statement imho. I work for Tumblr, and we run independently still. That being said, a companies policy does not reflect every employee, especially when you have a company that employees over 11k people. I think it's great they are making a policy change, and making it retroactive even. My opinion is facing the community and the perceived entitlement people have at getting something for reporting a bug. I applaud those that have policies in place, but the community is shining a bad light on itself with the outrage.
    - nknighthb 13y ago
      It's amazing how every time Yahoo is in the news, I end up that much more grateful to have rejected their job offer. Every act an employee takes and every word they speak while on the job is directly attributable to their employer. No exceptions, no excuses, ever. It doesn't matter if it was against policy, and it doesn't matter how many employees there are. The company must take responsibility. It reflects extremely poorly on the corporate culture of Yahoo and Tumblr that you don't recognize that.
      - elliottcarlson 13y ago
        We have different opinions and different values. I value my right to speak freely and not in representation of my employer. I wouldn't judge your employer for your words, hobbies, extracurricular activities - they are not a representation of you, nor are you a representation on them. If you feel otherwise, that's your right to do so - I hope that the corporate culture that you found suits you better then the one that works for me.

by yogo 13y ago

eli 13y ago

Sorry, but I don't get this mindset. It would have been better to give them nothing rather than a "cheap" gift? If you want to get paid market rate for the value you provide as a security researcher, then stop doing work on spec and just hoping that someone compensates you for it.

bryanlarsen 13y ago
"Sorry, but I don't get this mindset. It would have been better to give them nothing rather than a "cheap" gift?" Standard practice to deliberately insult a waitress is to leave a short tip. That's more insulting than leaving nothing.
- zequel 13y ago
  Probably related to the fact that the waitress can justify no tip with the thought "they might have forgotten to leave one". A short tip sends a message.
- nmcfarl 13y ago
  Which is a good point - as it gives illustration to mikeash's point in this same thread. This doesn’t make logical sense at all - but there are practices based on it. And in this case both the "a token of our appreciation" and "short tip" practices could been "meant", and were as a matter of fact taken as "meant" by the sender and receiver respectively.
- Suitov 13y ago
  Oh hell, is it? Quite often I'm short on cash and just tip with the change I have - not tiny-denomination coins, I hasten to add, but 50ps/£1s. Bugger.
yogo 13y ago
Yahoo is free to do whatever they want. I think that's obvious. My opinion from the sidelines reflects what I think it looks like. Certain things become the norm, for e.g. someone finds $100K and returns it, the norm is to pay them a nice reward for doing so. There is absolutely no agreement or law in place that says they have to get anything in return. In fact, neither I nor most people I know expect anything in return for doing the right thing. What would your reaction be if the finder received nothing? Just in case you want to know where I stand: if I find $100K in cash and there is no way to trace it back to me I'm not returning it. However, that is different to finding a bug and selling it for monetary gain.
mikeash 13y ago
> It would have been better to give them nothing rather than a "cheap" gift? YES! There seem to be two camps here, neither of which can even fathom the other's position. On your side, we have people who do a purely logical comparison that non-zero is greater than zero, so this is better. On my side, we have people who inherently separate tasks done for free for fun or just to be nice, from tasks done for money. For these people, getting paid a pittance is a grave insult, while not getting paid at all (when nothing is owed) is just fine. I don't really know how to explain it any further. I think the people in your camp just need to understand that the other camp exists and contains a lot of people, and that regardless of logic, giving someone a $12.50 gift card is a massive insult, far worse than giving them nothing. You don't have to understand why, but you have to know that this is how it is for a lot of people.
- yogo 13y ago
  I wish a sociologist or anthropologist would comment and explain formally what this is but I'm thinking it is something along the lines of a thank you or appreciation not being quantifiable. Where as putting money (or something quantifiable) on the table communicates some sort of value.
  - mikeash 13y ago
    Yeah, I'd like a better explanation myself. I feel it, but I can't really explain why. It seems like there are just two distinct modes. When you do something for free, you're basically doing a favor, and you get pleasure from being altruistic. Once you get paid, it's now an exchange of value, not altruism, so you only get pleasure from being paid. If the pay is small, you'll feel upset because your end of the bargain is based entirely on that, while if you're doing it for free, you switch over. I could be full of it....
  - asmithmd1 13y ago
    Yahoo "owed him one" when he reported the vulerabilty. When they traded a shirt for the report Yahoo was implying that they no longer owed him anything, it was a fair barter
  - 13y ago
ronaldx 13y ago
> It would have been better to give them nothing rather than a "cheap" gift? Yes. Giving nothing doesn't give any indication of value - maybe the work is very highly valued but it's not Yahoo's policy to compensate. Fair enough. Giving a cheap gift attaches a very particular value. There is a body of research on this, e.g. http://ideas.repec.org/p/zur/iewwpx/007.html http://ideas.repec.org/p/zur/iewwpx/007.html "rewards undermine the intrinsic motivation of volunteers." "a large literature in social psychology [emphasizes] that external rewards can undermine the intrinsic motivation for an activity"
kens 13y ago
There's a big discussion of this in the book "Predictably Irrational", chapter 4: "Why we are happy to do things, but not when we are paid to do them". It explains that there are two worlds: The first is "social norms", which is community based. This is where you have friends over for dinner, help someone move a couch, and other friendly things. The other world is "market norms", where things are transaction based with something exchanged for something of equal value (normally, but not always money). The problem is when the worlds of social norms and market norms cross. The book gives the example of Thanksgiving dinner, and what would happen if you offered your mother-in-law a couple hundred dollars to pay for the meal at the end. Another example is sex: paying for sex makes it a very different situation. (Also note the difference between giving someone flowers on a date and giving someone cash.) The book describes a research experiment, where participants were paid $5, 50 cents, or nothing to perform a short task of sorting shapes. The people paid $5 sorted 50% more shapes than the people paid less (since they were more motivated), but the people paid nothing did the most of all since they were motivated by helping out the researchers. This ties in with intrinsic vs extrinsic motivation - if you're getting paid, it's extrinsic motivation, and then you're motivated by whether you're getting your money's worth. (There's a lot more, but I don't have time to get into it, so check out the book.) The point is, that if people report bugs for free, it's part of the social norms world, where they are keeping the world safe, making it a better place, etc. If they are getting paid, it's part of the market norms world, and they expect to get paid what the bug is worth. With Yahoo, the lines got crossed: giving a T-shirt is generally part of the social norms world, but giving a $12 gift certificate crosses over into the market norms world, and $12 is insultingly low. This is why it would have been better for Yahoo to give nothing.
- DanielStraight 13y ago
  Exactly. This guy accidentally crossed into market norms by doing something that seemed completely reasonable at the time. Imagine you ask a friend over to help fix your car in exchange for beer. This would clearly not be interpreted as payment, but as a way of saying thanks. Now suppose it turns out they generally like beer but hate the particular kind you purchased, so you feel bad and give them $10 to buy themselves a beer they like. Suddenly, thinking you were doing something nice, you've crossed into market norms. This, as far as I can tell, is basically what happened.
wpietri 13y ago
I was once at a busy bar. The guy in front of me, his order came to $9.75. He gave the bartender $10; she gave him a quarter back as she delivered the last of his drinks. He tried to leave the $0.25 as a tip. She said, "Oh, no, you must need this," and gave it back to him. Her clear view was that no tip was better than $0.25. I congratulated her, and made up for his idiocy with my tip. If you don't tip at all, you're either clueless or an asshole. Tipping a quarter is more insulting: you're acknowledging the need to tip, but making it clear you don't think much of the bartender.
danielweber 13y ago
I would think he avoided the concept of paying them by giving a gift instead, which sidesteps the concept of "pay" the same way an honorarium[1] would. I was at a company where someone reported a security problem to the support team. I didn't quite believe it, but they got me on the phone, and within 10 seconds the guy had said the right words to tell me he had found something. So we fixed it. What then? The company had no formal bounty system in place. I said we should send him something, so I got him an Amazon gift card and sent it to him along with a letter of thanks. He said thank you back to us. It all seemed good, but maybe it was just luck of the draw that an Internet mob didn't show up for me the next day. [1] http://en.wikipedia.org/wiki/Honorarium http://en.wikipedia.org/wiki/Honorarium

res0nat0r 13y ago

Yet there have been dozens upon dozens of threads in this same forum of people making up all kinds of explanations of why they don't want to pay $15 for a music cd they will listen to possibly dozens of times over their lifetime. Ironic...

snarfy 13y ago

It implicitly meant they don't really value security.

yogo 13y ago
Exactly. When that comment came from a Yahoo employee I caught a glimpse of what I think the company's attitude towards security is. To me it seemed like there was no understanding that by not taking care of the little things that are lurking in the dark it can cost the company big time. Yes, I know this is an employee's personal opinion, but still...
- elliottcarlson 13y ago
  Kind of an unfair statement imho. I work for Tumblr, and we run independently still. That being said, a companies policy does not reflect every employee, especially when you have a company that employees over 11k people. I think it's great they are making a policy change, and making it retroactive even. My opinion is facing the community and the perceived entitlement people have at getting something for reporting a bug. I applaud those that have policies in place, but the community is shining a bad light on itself with the outrage.
  - nknighthb 13y ago
    It's amazing how every time Yahoo is in the news, I end up that much more grateful to have rejected their job offer. Every act an employee takes and every word they speak while on the job is directly attributable to their employer. No exceptions, no excuses, ever. It doesn't matter if it was against policy, and it doesn't matter how many employees there are. The company must take responsibility. It reflects extremely poorly on the corporate culture of Yahoo and Tumblr that you don't recognize that.
    - elliottcarlson 13y ago
      We have different opinions and different values. I value my right to speak freely and not in representation of my employer. I wouldn't judge your employer for your words, hobbies, extracurricular activities - they are not a representation of you, nor are you a representation on them. If you feel otherwise, that's your right to do so - I hope that the corporate culture that you found suits you better then the one that works for me.