4 ms·

Pretty slick way to earn 20 grand...nice work

by brotoss 12y ago

stevenh 12y ago
Taking the following into consideration: - The severity of the exploit, which may be nearly the maximum theoretical possibility on a site like Facebook, aside from SQL injection or remote code execution - The multiple months worth of unpaid sleepless nights Stephen Sclafani likely spent exploring countless dead-ends before finding this - The fact that he beat black hats to the punch by discovering it first and thus saved Facebook and its users from millions, perhaps billions, of dollars worth of damages stemming from vague and mysterious causes over an indefinite period of time - The billions of dollars Facebook regularly uninhibitedly spends to acquire a given startup I feel that $20,000 is a bit low.
- StevenRayOrr 12y ago
  > Insultingly low. Oy. Not that I am going to pretend that I know what the dollar value of Sclafani's time/effort should be, but I have a hard time believing that $20,000 is an insult. Just because he could get more money by exploiting the bug -- or showing others how to exploit it -- doesn't necessarily suggest to me that he should get paid more than he did.
  - argonaut 12y ago
    The price you can get for something == its value.
    - nbm 12y ago
      That's not totally accurate - sometimes you're exchanging more than just the item in question, for example, putting yourself in danger. In other words, if you can sell an item for $100k if you follow a set of laws (a government's, an organisation's, a community's, or your own), but you could sell the item without doing so for $500k, the item is still really only worth $100k (to you), but the (physical/societal/moral) danger involved in selling the item illegally that goes with it is not worth $400k to you. Or, put another way, the item may be valued at $500k (to some potential buyer), but the legal buyer of the item is offering not to put you in danger in exchange for $400k.
      - deleted 12y ago
        [deleted]
- lstyls 12y ago
  "Insultingly low." Really? 20K is about two months of salary for a Facebook engineer. So even if he did spend months on this like you speculate (he didn't) it's still an industry-leading salary.
  - voltagex_ 12y ago
    Holy crap, I'm working for the wrong company.
- ohitsdom 12y ago
  I thought $20k was really low. GREAT value for Facebook. In the hands of black hats, trust in Facebook could have been destroyed before they had time to patch the vulnerability.
  - deleted 12y ago
    [deleted]

Pretty slick way to earn 20 grand...nice work

by brotoss 12y ago

Pretty slick way to earn 20 grand...nice work

Taking the following into consideration: - The severity of the exploit, which may be nearly the maximum theoretical possibility on a site like Facebook, aside from SQL injection or remote code execution - The multiple months worth of unpaid sleepless nights Stephen Sclafani likely spent exploring countless dead-ends before finding this - The fact that he beat black hats to the punch by discovering it first and thus saved Facebook and its users from millions, perhaps billions, of dollars worth of damages stemming from vague and mysterious causes over an indefinite period of time - The billions of dollars Facebook regularly uninhibitedly spends to acquire a given startup I feel that $20,000 is a bit low.

StevenRayOrr 12y ago
> Insultingly low. Oy. Not that I am going to pretend that I know what the dollar value of Sclafani's time/effort should be, but I have a hard time believing that $20,000 is an insult. Just because he could get more money by exploiting the bug -- or showing others how to exploit it -- doesn't necessarily suggest to me that he should get paid more than he did.
- argonaut 12y ago
  The price you can get for something == its value.
  - nbm 12y ago
    That's not totally accurate - sometimes you're exchanging more than just the item in question, for example, putting yourself in danger. In other words, if you can sell an item for $100k if you follow a set of laws (a government's, an organisation's, a community's, or your own), but you could sell the item without doing so for $500k, the item is still really only worth $100k (to you), but the (physical/societal/moral) danger involved in selling the item illegally that goes with it is not worth $400k to you. Or, put another way, the item may be valued at $500k (to some potential buyer), but the legal buyer of the item is offering not to put you in danger in exchange for $400k.
    - deleted 12y ago
      [deleted]
lstyls 12y ago
"Insultingly low." Really? 20K is about two months of salary for a Facebook engineer. So even if he did spend months on this like you speculate (he didn't) it's still an industry-leading salary.
- voltagex_ 12y ago
  Holy crap, I'm working for the wrong company.
ohitsdom 12y ago
I thought $20k was really low. GREAT value for Facebook. In the hands of black hats, trust in Facebook could have been destroyed before they had time to patch the vulnerability.
- deleted 12y ago
  [deleted]