>Great on Yahoo for putting a reward program in place, but when did everyone become so entitled to getting something for reporting a bug/security concern. For

>Great on Yahoo for putting a reward program in place, but when did everyone become so entitled to getting something for reporting a bug/security concern. For better or for worse, cyber criminals started paying black hats for exclusive access to vulnerabilities, and now "good guys" such as the NSA and the FBI are paying grey hats for exclusive access to vulnerabilities. At this point, if you are a security researcher, if you voluntarily disclose a vulnerability you find to a company like Yahoo or Microsoft, even with the fairly generous rewards getting paid out, it's likely they will be taking a monetary hit compared to what an organization like the NSA would be willing to pay. Fortunately, there are still people who have enough of a conscience that they still care about doing the right thing, as opposed to optimizing for their monetary return (and if you are selling to the government agency like the NSA, you are automatically on the side of the angels, right?). But if you are looking for someone to blame, I'd nominate organizations like the NSA and the cyber-criminals. That's not particularly constructive, though --- the world is the way it is now, and it's unlikely to be something that can be changed back to the "Good Old Days" (which, for the record, was never really all that Good).