4 ms·

I feel like this is a stupid question, but: Why would people get mad at him for sending out t-shirts (i.e. tshirt-gate)?

by umsm 13y ago

duskwuff 13y ago
Because they weren't sending out T-shirts; they were sending out gift certificates for $12. When it's presented that way, it feels like Yahoo is trying to say that's all the report was worth to them.
- aestra 13y ago
  It's like this. Imagine if you were outside shoveling a decent amount of snow then your neighbor asked you to help shovel his property. If you haven't shoveled snow before, it can be a somewhat laborious task. After you were finished your neighbor said "Thanks for helping me out" and then gave you 50 cents. It would have been better if they just said "thanks."
  - talmand 13y ago
    Then that makes you a somewhat bad neighbor. Did the neighbor promise to give something in return before you began? Because if you start something with no promise of anything in return, then you shouldn't expect more than a thank you. To perform such a favor, then to expect something in return that was not offered reflects badly on you. Or maybe your analogy doesn't work in this case.
    - aestra 13y ago
      Wow. You complete and totally 100% missed the point of my story. I used the example of neighbors because they are (in some neighbors) neighborly, and do altruistic things for each other. When there is a big snowfall in my neighborhood, all my neighbors come out and help each other shovel. There is mostly apartments here, so very few people own a snow blower and everyone needs to dig their cars out. I live alone and whenever someone sees me shoveling by myself, someone always comes over and helps me shovel without expectation of anything in return and its always a different person from last time. When I make baked goods, I usually stop by the people who live in my building's apartments to see if they would like some of what I made. I once needed help carrying something up the stairs, so I just knocked on a neighbor's door and he came out to help me. This it the neighbor who doesn't have to pay for internet because I let him use my WiFi. There's somewhat of an "rule" if someone is in need of something, they just need to ask, and everything works because the give and take is pretty even, nobody takes and takes and takes without giving. The point is, the person shoveling snow did it to be nice, and to help a neighbor out. Once the person being helped offered a reward in return, they are now putting a monetary value on the help they received and the value was insultingly low, saying "this is how much I value you." If they just said "Thank you very much" then it just remains as an altruistic gift to the community. I used the neighbor example to make altruism more evident, to not think of it from a purely business prospective. Yahoo have 2 choices to not offend people: 1) Bug finding is simply an altruistic act from the community. 2) Pair fair compensation.
      - talmand 13y ago
        I would say, based on your follow-up, that I understood your story quite well. Just because someone gives you pocket change for helping them out doesn't mean they put that particular monetary value on your help, it could be just what they had on hand. As in, "here's a little more than just my thanks". You're the one getting needlessly offended. You could always turn down the offer, which you shouldn't because it could be considered offensive to refuse. Out of all the options you have in that case, you choose to be offended. That makes you a bad neighbor. I fail to see how one can expect any form of compensation whatsoever from Yahoo when none was offered in the first place. Just because some places offer bounties doesn't automatically mean everyone does. If you expect compensation when none was offered, then it's your problem with being offended when not getting anything.
k3n 13y ago
Because it's pretty much an industry standard now, for those with a prominent web presence, to have an official bug bounty program[1]. Google, though likely not the first, is one of the more prominent companies to offer this -- and has been for several years -- to the tune of $100-$20,000[2]. A $10 t-shirt is laughable compared to that, to the point of almost being insulting. Was it poor form to expect grandiose payouts from a company without a bona fide bug bounty program? I think so. Is it even sadder that, up until publicly shamed, Yahoo had no bug bounty program whatsoever? Definitely. 1. https://bugcrowd.com/list-of-bug-bounty-programs/ https://bugcrowd.com/list-of-bug-bounty-programs/ 2. http://www.google.com/about/appsecurity/reward-program/ http://www.google.com/about/appsecurity/reward-program/
- deleted 13y ago
  [deleted]
- daeken 13y ago
  > Because it's pretty much an industry standard now, for those with a prominent web presence, to have an official bug bounty program This is so wrong, it's not even funny. Bug bounty programs are awesome -- I've participated in many of them -- but they're a tiny, tiny, TINY minority. Of the top 500 websites, how many have bug bounties? 10? That's not an industry standard; it's a nicety. That's changing, but seriously, there's absolutely nothing wrong with not having a bug bounty program right now.
  - k3n 13y ago
    Aye, good point, perhaps I should have said "...is quickly becoming the standard". However, would it be fair to say that a majority of Yahoo's competitors have bounty programs? Google, Microsoft, etc.
    - daeken 13y ago
      Microsoft has done some extremely limited bug bounties, but zero on the web side of things. Google, yes. But there are tons of major sites that don't have them, even the engineering-focused ones. Twitter being a great example.

I feel like this is a stupid question, but: Why would people get mad at him for sending out t-shirts (i.e. tshirt-gate)?

by umsm 13y ago

I feel like this is a stupid question, but: Why would people get mad at him for sending out t-shirts (i.e. tshirt-gate)?

duskwuff 13y ago

Because they weren't sending out T-shirts; they were sending out gift certificates for $12. When it's presented that way, it feels like Yahoo is trying to say that's all the report was worth to them.

aestra 13y ago
It's like this. Imagine if you were outside shoveling a decent amount of snow then your neighbor asked you to help shovel his property. If you haven't shoveled snow before, it can be a somewhat laborious task. After you were finished your neighbor said "Thanks for helping me out" and then gave you 50 cents. It would have been better if they just said "thanks."
- talmand 13y ago
  Then that makes you a somewhat bad neighbor. Did the neighbor promise to give something in return before you began? Because if you start something with no promise of anything in return, then you shouldn't expect more than a thank you. To perform such a favor, then to expect something in return that was not offered reflects badly on you. Or maybe your analogy doesn't work in this case.
  - aestra 13y ago
    Wow. You complete and totally 100% missed the point of my story. I used the example of neighbors because they are (in some neighbors) neighborly, and do altruistic things for each other. When there is a big snowfall in my neighborhood, all my neighbors come out and help each other shovel. There is mostly apartments here, so very few people own a snow blower and everyone needs to dig their cars out. I live alone and whenever someone sees me shoveling by myself, someone always comes over and helps me shovel without expectation of anything in return and its always a different person from last time. When I make baked goods, I usually stop by the people who live in my building's apartments to see if they would like some of what I made. I once needed help carrying something up the stairs, so I just knocked on a neighbor's door and he came out to help me. This it the neighbor who doesn't have to pay for internet because I let him use my WiFi. There's somewhat of an "rule" if someone is in need of something, they just need to ask, and everything works because the give and take is pretty even, nobody takes and takes and takes without giving. The point is, the person shoveling snow did it to be nice, and to help a neighbor out. Once the person being helped offered a reward in return, they are now putting a monetary value on the help they received and the value was insultingly low, saying "this is how much I value you." If they just said "Thank you very much" then it just remains as an altruistic gift to the community. I used the neighbor example to make altruism more evident, to not think of it from a purely business prospective. Yahoo have 2 choices to not offend people: 1) Bug finding is simply an altruistic act from the community. 2) Pair fair compensation.
    - talmand 13y ago
      I would say, based on your follow-up, that I understood your story quite well. Just because someone gives you pocket change for helping them out doesn't mean they put that particular monetary value on your help, it could be just what they had on hand. As in, "here's a little more than just my thanks". You're the one getting needlessly offended. You could always turn down the offer, which you shouldn't because it could be considered offensive to refuse. Out of all the options you have in that case, you choose to be offended. That makes you a bad neighbor. I fail to see how one can expect any form of compensation whatsoever from Yahoo when none was offered in the first place. Just because some places offer bounties doesn't automatically mean everyone does. If you expect compensation when none was offered, then it's your problem with being offended when not getting anything.

k3n 13y ago

Because it's pretty much an industry standard now, for those with a prominent web presence, to have an official bug bounty program[1]. Google, though likely not the first, is one of the more prominent companies to offer this -- and has been for several years -- to the tune of $100-$20,000[2]. A $10 t-shirt is laughable compared to that, to the point of almost being insulting. Was it poor form to expect grandiose payouts from a company without a bona fide bug bounty program? I think so. Is it even sadder that, up until publicly shamed, Yahoo had no bug bounty program whatsoever? Definitely. 1. https://bugcrowd.com/list-of-bug-bounty-programs/ https://bugcrowd.com/list-of-bug-bounty-programs/ 2. http://www.google.com/about/appsecurity/reward-program/ http://www.google.com/about/appsecurity/reward-program/

deleted 13y ago
[deleted]
daeken 13y ago
> Because it's pretty much an industry standard now, for those with a prominent web presence, to have an official bug bounty program This is so wrong, it's not even funny. Bug bounty programs are awesome -- I've participated in many of them -- but they're a tiny, tiny, TINY minority. Of the top 500 websites, how many have bug bounties? 10? That's not an industry standard; it's a nicety. That's changing, but seriously, there's absolutely nothing wrong with not having a bug bounty program right now.
- k3n 13y ago
  Aye, good point, perhaps I should have said "...is quickly becoming the standard". However, would it be fair to say that a majority of Yahoo's competitors have bounty programs? Google, Microsoft, etc.
  - daeken 13y ago
    Microsoft has done some extremely limited bug bounties, but zero on the web side of things. Google, yes. But there are tons of major sites that don't have them, even the engineering-focused ones. Twitter being a great example.