4 ms·
Why not just do the same for physical locations? You walk around a parking lot checking car doors, or maybe all the doors in an apartment building. If you find
by kneisley 13y ago
Why not just do the same for physical locations? You walk around a parking lot checking car doors, or maybe all the doors in an apartment building. If you find one unlocked, you text the owner and some local thieves so they can bid on the vulnerability...
Usually, behavior that would be shitty if done offline is just as shitty online. There is a fine line between freelance security research for bug bounties, which is basically crowdsourcing security testing, and rank extortion.
- eloff 13y agoNo, because in the car metaphor the person with the unlocked door is not putting thousands of innocents at risk. Now if he had an unlocked door, and the sign outside his building happened to read "Joe's Firearms and Ammunition" then forcing Joe to be more careful with his security, no matter if it's unpleasant for Joe, is a good thing for society on the whole. Doing that by auctioning the location of his store to thieves is obviously unethical.
- Tomte 13y agoBut he is putting innocents at risk. That's why in my jurisdiction you can get fined up to 2000 Euros for that (a realistic amount is a low double-digit amount -- if nothing further happens, of course).
- PeterisP 13y agoNope, Yahoo is putting innocents at risk for having the bug in the first place - the bug/risk/threat was there (and possibly known by blackhats) before the finding. It's the duty of Yahoo to find and fix issues with data that is entrusted to Yahoo - they can try to find everything themselves, or they can pay others to do it instead.