4 ms·

> separate tasks done for free for fun or just to be nice, from tasks done for money Sure. But given the lack of a formal bounty program at Yahoo!, it was a po

> separate tasks done for free for fun or just to be nice, from tasks done for money Sure. But given the lack of a formal bounty program at Yahoo!, it was a poor choice to pick them as a place for "tasks done for money"

mikeash 13y ago
They didn't necessarily pick that, though. When you submit a vulnerability to a company that doesn't have such a program in place, it is their choice as to whether that falls into the "free" or "paid" category. Yahoo's reaction put it into the "paid" category, and then paid an insultingly low amount. That was their error. A different reaction, even just different wording when sending the gift card, could have put it into the "free" category.
- jack-r-abbit 13y ago
  You can see it as an insultingly low payment or as a bigger than usual thank you. If you expected nothing, the shirt is a pretty decent thank you. If you expected to be paid, the shirt is an insult. Clearly the people who bitched about the shirt expected to get paid. So they had already put their work in the "paid" category and then complained when the pay was low. It sounds like a lot of other people didn't expect anything and put their work in the "free" category and were (at least a little) pleased to get an unexpected thank you.
  - tomjen3 13y ago
    You are misunderstanding things. A dollar amount automatically puts it into the paid category, because it is comparable.
    - jack-r-abbit 13y ago
      You are misunderstanding things. It used to just be an actual t-shirt. But people who already had a t-shirt said they didn't need another one. So an equivalent amount of store credit was given to get something other than a t-shirt. I guess he could have just offered for them to pick from a few different schwag items. Any physical item as a thank you is going to have some sort of dollar value... but I still don't think that automatically puts it into the paid category.

mikeash 13y ago

They didn't necessarily pick that, though. When you submit a vulnerability to a company that doesn't have such a program in place, it is their choice as to whether that falls into the "free" or "paid" category. Yahoo's reaction put it into the "paid" category, and then paid an insultingly low amount. That was their error. A different reaction, even just different wording when sending the gift card, could have put it into the "free" category.

jack-r-abbit 13y ago
You can see it as an insultingly low payment or as a bigger than usual thank you. If you expected nothing, the shirt is a pretty decent thank you. If you expected to be paid, the shirt is an insult. Clearly the people who bitched about the shirt expected to get paid. So they had already put their work in the "paid" category and then complained when the pay was low. It sounds like a lot of other people didn't expect anything and put their work in the "free" category and were (at least a little) pleased to get an unexpected thank you.
- tomjen3 13y ago
  You are misunderstanding things. A dollar amount automatically puts it into the paid category, because it is comparable.
  - jack-r-abbit 13y ago
    You are misunderstanding things. It used to just be an actual t-shirt. But people who already had a t-shirt said they didn't need another one. So an equivalent amount of store credit was given to get something other than a t-shirt. I guess he could have just offered for them to pick from a few different schwag items. Any physical item as a thank you is going to have some sort of dollar value... but I still don't think that automatically puts it into the paid category.