4 ms·
Because it's pretty much an industry standard now, for those with a prominent web presence, to have an official bug bounty program[1]. Google, though likely not
by k3n 13y ago
Because it's pretty much an industry standard now, for those with a prominent web presence, to have an official bug bounty program[1]. Google, though likely not the first, is one of the more prominent companies to offer this -- and has been for several years -- to the tune of $100-$20,000[2]. A $10 t-shirt is laughable compared to that, to the point of almost being insulting.
Was it poor form to expect grandiose payouts from a company without a bona fide bug bounty program? I think so.
Is it even sadder that, up until publicly shamed, Yahoo had no bug bounty program whatsoever? Definitely.
1. https://bugcrowd.com/list-of-bug-bounty-programs/ https://bugcrowd.com/list-of-bug-bounty-programs/
2. http://www.google.com/about/appsecurity/reward-program/ http://www.google.com/about/appsecurity/reward-program/
- deleted 13y ago[deleted]
- daeken 13y ago> Because it's pretty much an industry standard now, for those with a prominent web presence, to have an official bug bounty program This is so wrong, it's not even funny. Bug bounty programs are awesome -- I've participated in many of them -- but they're a tiny, tiny, TINY minority. Of the top 500 websites, how many have bug bounties? 10? That's not an industry standard; it's a nicety. That's changing, but seriously, there's absolutely nothing wrong with not having a bug bounty program right now.
- k3n 13y agoAye, good point, perhaps I should have said "...is quickly becoming the standard". However, would it be fair to say that a majority of Yahoo's competitors have bounty programs? Google, Microsoft, etc.
- daeken 13y agoMicrosoft has done some extremely limited bug bounties, but zero on the web side of things. Google, yes. But there are tons of major sites that don't have them, even the engineering-focused ones. Twitter being a great example.