3 ms·

So what you're saying is that you're the kind of person that needs to be paid to not be a dick? Uh, congratulations?

• eloff 13y ago
  No, if you read more closely, you'll see I'm the kind of person who likes to get paid for being a dick. My comment is a bit tongue-in-cheek, but the moral questions it raises are interesting. Well-being of company vs user. Short-term user security verus long-term user security. I don't think you can say categorically that it would be wrong, in some cases it could play out better for the innocent users. However, I don't think I'd really be comfortable selling an exploit to any party other than the company, but as mentioned in another of my comments here, the auction could be a bluff (especially if it's a hidden auction.)
  • antimagic 13y ago
    Lol, fair enough ;) Still, I think that the moral action (wherby "moral" I mean being disinterested and caring about outcomes for users) is fairly obvious in this specific case (Yahoo, has a good rep for taking security-issues seriously) - send them the patch that you have, regardless of compensation.
    • eloff 13y ago
      Yes, that's definitely more moral than my suggestion. However, you have to remember that not all "security researchers" are going to be so moral, and many of the more moral ones will simply not bother because they're not getting paid for their work. So users both gain and lose when you report an issue without compensation. It seems to me to be better to try to force the company into changing their policy, like what happened in this story. But it should be done without putting innocent users at risk (contrary to my original comment.)