6 ms·

Exactly. When that comment came from a Yahoo employee I caught a glimpse of what I think the company's attitude towards security is. To me it seemed like there

by yogo 13y ago

Exactly. When that comment came from a Yahoo employee I caught a glimpse of what I think the company's attitude towards security is. To me it seemed like there was no understanding that by not taking care of the little things that are lurking in the dark it can cost the company big time. Yes, I know this is an employee's personal opinion, but still...

elliottcarlson 13y ago
Kind of an unfair statement imho. I work for Tumblr, and we run independently still. That being said, a companies policy does not reflect every employee, especially when you have a company that employees over 11k people. I think it's great they are making a policy change, and making it retroactive even. My opinion is facing the community and the perceived entitlement people have at getting something for reporting a bug. I applaud those that have policies in place, but the community is shining a bad light on itself with the outrage.
- nknighthb 13y ago
  It's amazing how every time Yahoo is in the news, I end up that much more grateful to have rejected their job offer. Every act an employee takes and every word they speak while on the job is directly attributable to their employer. No exceptions, no excuses, ever. It doesn't matter if it was against policy, and it doesn't matter how many employees there are. The company must take responsibility. It reflects extremely poorly on the corporate culture of Yahoo and Tumblr that you don't recognize that.
  - elliottcarlson 13y ago
    We have different opinions and different values. I value my right to speak freely and not in representation of my employer. I wouldn't judge your employer for your words, hobbies, extracurricular activities - they are not a representation of you, nor are you a representation on them. If you feel otherwise, that's your right to do so - I hope that the corporate culture that you found suits you better then the one that works for me.
    - nknighthb 13y ago
      > I value my right to speak freely and not in representation of my employer. You fail to understand two things. The first is that you have no such "right". You are speaking as a representative of your employer when others perceive you to be. What you or your employer think is irrelevant. The second is that this isn't about you. Whether you must take responsibility internally is up to your employer. But whether your employer must take responsibility in public is not. It has nothing to do with your "rights". You don't have a say in the matter.
oijaf888 13y ago
Because an employee feels that a lot of people have an entitled view towards security payouts as opposed to just reporting them because its the right thing to do...this means that that Yahoo has a bad attitude towards security? Could you please explain your logic there?
- yogo 13y ago
  I felt like if there is a company culture where everyone understands that security vulnerabilities can be costly then there wouldn't even be a discussion about security researchers being entitled, there would be a good bug bounty program in place from the get go. Maybe my logic is flawed but to me no bug bounty program says we really don't care enough about this and it's not a big priority, we'll just let/hope people do the right thing and report problems because that's how big internet companies do things in 2013. That's how I see things from the outside, I don't have any inside information and it could very well turn out they have most of their staff working on software testing and security.

by yogo 13y ago

elliottcarlson 13y ago

Kind of an unfair statement imho. I work for Tumblr, and we run independently still. That being said, a companies policy does not reflect every employee, especially when you have a company that employees over 11k people. I think it's great they are making a policy change, and making it retroactive even. My opinion is facing the community and the perceived entitlement people have at getting something for reporting a bug. I applaud those that have policies in place, but the community is shining a bad light on itself with the outrage.

nknighthb 13y ago
It's amazing how every time Yahoo is in the news, I end up that much more grateful to have rejected their job offer. Every act an employee takes and every word they speak while on the job is directly attributable to their employer. No exceptions, no excuses, ever. It doesn't matter if it was against policy, and it doesn't matter how many employees there are. The company must take responsibility. It reflects extremely poorly on the corporate culture of Yahoo and Tumblr that you don't recognize that.
- elliottcarlson 13y ago
  We have different opinions and different values. I value my right to speak freely and not in representation of my employer. I wouldn't judge your employer for your words, hobbies, extracurricular activities - they are not a representation of you, nor are you a representation on them. If you feel otherwise, that's your right to do so - I hope that the corporate culture that you found suits you better then the one that works for me.
  - nknighthb 13y ago
    > I value my right to speak freely and not in representation of my employer. You fail to understand two things. The first is that you have no such "right". You are speaking as a representative of your employer when others perceive you to be. What you or your employer think is irrelevant. The second is that this isn't about you. Whether you must take responsibility internally is up to your employer. But whether your employer must take responsibility in public is not. It has nothing to do with your "rights". You don't have a say in the matter.

oijaf888 13y ago

Because an employee feels that a lot of people have an entitled view towards security payouts as opposed to just reporting them because its the right thing to do...this means that that Yahoo has a bad attitude towards security? Could you please explain your logic there?

yogo 13y ago
I felt like if there is a company culture where everyone understands that security vulnerabilities can be costly then there wouldn't even be a discussion about security researchers being entitled, there would be a good bug bounty program in place from the get go. Maybe my logic is flawed but to me no bug bounty program says we really don't care enough about this and it's not a big priority, we'll just let/hope people do the right thing and report problems because that's how big internet companies do things in 2013. That's how I see things from the outside, I don't have any inside information and it could very well turn out they have most of their staff working on software testing and security.