As promised, Kim Dotcom starts payouts for Mega vulnerability reward program

http://thenextweb.com/insider/2013/02/10/as-promised-kim-dotcom-starts-payouts-for-mega-vulnerability-reward-program-seven-bugs-fixed-in-first-week/

by Lightning • 13 years ago

75 29 13 years ago

thenextweb.com

DigitalSea3• 13 years ago

I really think Dotcom is making all of the right moves here. I remember reading a multitude of comments from people on various sites saying that he would rip people off with his "vulnerability reward program" but here we are, Dotcom is putting his money where his mouth is and paying out the money. Mega is definitely a rising force and once the kinks are ironed out, Hollywood should be very scared.

trotsky3• 13 years ago

wait, how much money did he pay out to whom? what would be the point of not listing who is being paid nor what they're being paid except for deception?

DigitalSea3• 13 years ago

Does it matter how much money he paid out and to who? Things are getting fixed by the looks of it. Do Google or Facebook release a list of names and how much they paid for their bounty programs? (I did a search, but couldn't find anything, so maybe they do). If Dotcom were to try and rip someone off, sites like Techcrunch would foam at the mouth to release a story like that. Everyone loves to hate Dotcom, the insinuation in your comment about deception proves this very fact (unless you have evidence that proves he is being deceptive and hiding the information for nefarious reasons?).

redthrowaway• 13 years ago

Well, there's the one email where they've offered 1000 EUR ($1336.20 at today's rates) for an XSS bug. It seems they've been following up on it, and you'll certainly hear about it if they don't.

phaus2• 13 years ago

Responsible disclosure includes protecting the privacy of everyone involved. If the people who have been awarded bounties want the publicity, I'm sure they will let us know who they are.

Cushman• 13 years ago

Why on earth would someone suspect that? I mean, given Mega's cash:goodwill position, what would be their possible motive for welching out on a few $1000 bounties?

badgar• 13 years ago

I think most of the people saying "rip off" consider token $1k checks "ripping people off," considering implementing it correctly would require hiring talented engineers with expensive salaries. Given the giant holes punched in the original security implementation pretty much immediately after launch, he seems to have skimped on engineering talent preferring to instead pay these small bounties.

DigitalSea3• 13 years ago

Sometimes even the smartest and most expensive engineers fail to find things 14 year old kids in their poster-laden bedrooms seem to be able to find these days... Google, Facebook and other tech companies seem to see the value in having a bounty program for security issues and bugs as well and by the looks of it, Dotcom is offering the same reward amounts as Google and Facebook are offering, so I guess by your logic Google and Facebook (two companies with larger amounts of money and smart engineering hires) are ripping people off as well? You are forgetting that Dotcom has to hire competent engineers to fix the reported issues, I doubt a lot of people finding the bugs and vulnerabilities are providing code samples and fixes to Dotcom. They're merely finding the holes and it's up to Mega to get their team of engineers to fix the issues.

rlpb• 13 years ago

> considering implementing it correctly would require hiring talented engineers with expensive salaries

Perhaps this is a new business model, replacing the traditional model of hiring expensive engineers to achieve secure software development? If this is true, then we should all move to this new model and the existing "talented engineers with expensive salaries" are simply overpaid.

I don't actually think this is true, but if it were, what would be wrong with it?

alan_cx• 13 years ago

I dont. I think that is a post proof change in the stated criticism designed to save face having been proved wrong.

Not saying that applies to you as such, but I see that sort of argument creep way too often.

josscrowcroft• 13 years ago

I'm like 99% sure they intentionally left a few 'low-risk' vulnerabilities which they knew people would uncover (and be rewarded for) to entice the big boys of security probing to roll up their sleeves and get to work looking for the really big ones.

In the long run, they're paying a reasonable amount of money for an army of security consultants to give the service a once-over. Smart!

dexter313• 13 years ago

Why would you intentionally leave in potential vulnerabilities, if you hypothetically have the option to release bug free code and boast about it.

LeafStorm• 13 years ago

You never have the option of releasing bug-free code. So if they released code with bugs, called it bug-free, and boasted about it, someone would come along, prove them wrong, and embarrass them.

jlgreco• 13 years ago

Is it so implausible that they accidentally left a few low-risk bugs in such a rushed project? It would be pretty damn impressive if all those low-risk bugs were actually intentional.

chris_wot2• 13 years ago

OK, I take it back. He paid out, not that he would have ever read my original comment (or even this one), but I owe Kim an apology.

philliphaydon• 13 years ago

Good on Kim for paying them out.

As promised, Kim Dotcom starts payouts for Mega vulnerability reward program

Related Stories