Security researchers rewarded $12.50 voucher to buy Yahoo T-shirt

http://grahamcluley.com/2013/09/serious-yahoo-bug/

by Titanous • 13 years ago

65 20 13 years ago

grahamcluley.com

uncoder0• 13 years ago

What's XSS an usually worth? I'm guessing it varies by product and company but, I would venture to say about $500-1000.

Really puts the $12.50 in company store credit into perspective.

theboss• 13 years ago

It depends on severity but I believe at google the minimum is $1337.

With that being said, $12.50 is $12.50 more than PayPal's. I don't know anyone who has reported a vulnerability to PayPal that has actually received a reward.

mythealias• 13 years ago

I wonder if not paying would be better than paying a small amount.

chc• 13 years ago

Well, what an XSS is worth on the black market is not necessarily the same as what companies offer to researchers who report vulnerabilities. Many companies will offer nothing more than a "Thank you, so-and-so" somewhere on their site or in the release notes for the fix.

I think the problem with Yahoo's response is that it looks like they are actively being cheapskates. Almost universally, cheap is worse than no-money-involved. A "thank you" might be appreciated, a reasonable monetary reward will probably be appreciated, and even sending some free swag might read as a warm gesture, but offering a $12 store credit pretty explicitly says "I value this very little."

spicyj2• 13 years ago

If Yahoo! had just sent the researchers t-shirts directly with thank-you notes, perhaps they still would have been disappointed with the reward but I doubt they (or we) would be as offended.

Funny how actual cash evokes different reactions.

jessaustin• 13 years ago

Yahoo store credit is not "actual cash". b^)

spicyj2• 13 years ago

Oops, true. I forgot about that.

dromidas• 13 years ago

Yahoo CEO rename to Katherine Janeway. Fuck up seriously in the first episode, and now she's going to have to spend the rest of her time cleaning up her mess.

leggo2m• 13 years ago

Welp, it's better than being criminally prosecuted!

rdl• 13 years ago

I wonder if this is why I've been getting so much spam from Yahoo accounts (and actually sent from Yahoo's servers, from legitimate accounts).

wesleyac• 13 years ago

Personally, I'd prefer a little "Thank You" on some Yahoo site.

$12.50 seems insulting. "Oh, your time is worth $12.50 to us, but thanks for disclosing a huge XSS issue."

eli• 13 years ago

I don't think reporting security bugs is a great way to become rich. If you expect to be compensated you should convince Yahoo to hire you.

Is this worse than the many companies that have never given anything to any reporter?

nly2• 13 years ago

Good security practices are something that have to be woven into many departments: design, development, testing, etc. Most of the researchers who report these kinds of bugs are more like hunters than zoo keepers. They wan't to go where there's fresh game, and they specialise in shooting holes in shit. If you put them in a zoo, their skills are going to be wasted.

Besides, I suspect working as freelance l33t hacker is more profitable and gets you laid at parties.

pflats• 13 years ago

I'm sure the intention was something like, "Hey, we should send them a thank you package. T-shirts? But wait, we don't know their size. Oh, hang on, I have an idea!"

And then they end up looking like jerks.

nly2• 13 years ago

Source:

https://www.htbridge.com/news/what_s_your_email_security_wor...

fmavituna• 13 years ago

Times have changed. Back in the day all we hoped was not getting sued for reporting a bug and now we are actually defaming companies who are not giving away good enough bounties.

It's great to see that we came to this point.

Security researchers rewarded $12.50 voucher to buy Yahoo T-shirt

Related Stories