full-disclosure - Re: Serious Yahoo bug discovered. Researchers rewarded with $12.50

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAG-zyRzcw=PkMZWuo_U=wwr_WahnA379ePgTqt++LpGbZdZKQA@mail.gmail.com>
Date: Thu, 3 Oct 2013 04:13:11 -0400
From: Justin Ferguson <jf@...co.net>
To: Brandon Whaley <brandonw@...otionhosting.com>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Serious Yahoo bug discovered. Researchers
 rewarded with $12.50

> but that if one were to sell a useful exploit to nefarious entities, one would make significantly more.

wait.. there's nerfarious entities paying for XSS?

On Wed, Oct 2, 2013 at 12:31 PM, Brandon Whaley
<brandonw@...otionhosting.com> wrote:
> I think the point is not so much that $12.50 is a trivial sum to receive,
> but that if one were to sell a useful exploit to nefarious entities, one
> would make significantly more.  The point of bug bounties is to reduce the
> financial disparity between responsible reporting and selling it to people
> who'd abuse it.
>
>
> On Wed, Oct 2, 2013 at 11:48 AM, Justin Ferguson <jf@...co.net> wrote:
>>
>> not that its a fair payout, but for the sake of accuracy, wasnt this
>> actually $12.50 per XSS? Of those he turned in, how many were
>> legitimate threats? I haven't paid any attention to it-- bug bounties
>> are not economically viable for a person to make a living on
>> irrelevant of the payout.
>>
>> On Wed, Oct 2, 2013 at 11:32 AM, Ian Hayes <cthulhucalling@...il.com>
>> wrote:
>>
>> >
>> >
>> >
>> > On Wed, Oct 2, 2013 at 8:20 AM, Jordon Bedwell <envygeeks@...il.com>
>> > wrote:
>> >>
>> >> On Wed, Oct 2, 2013 at 10:19 AM, Ian Hayes <cthulhucalling@...il.com>
>> >> wrote:
>> >> > Paint it for us, o wise philosopher.
>> >>
>> >> Figure it out, I'm not your mother, I'm not here to teach you how
>> >> humans
>> >> behave.
>> >
>> >
>> > Sounds like someone has an overdeveloped sense of self-entitlement.
>> >
>> > _______________________________________________
>> > Full-Disclosure - We believe in it.
>> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> > Hosted and sponsored by Secunia - http://secunia.com/
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>
>
>
>
> --
> Best Regards,
> Brandon W.
> Tier 3 System Administrator
> InMotion Hosting Inc.
>
> 888-321-4678
> 757-416-6575 (Int'l)
> NEW: 24x7 EMAIL and PHONE Technical Support
>
> Did you know?
> We'll Build, Update and Promote Your Site for You! Visit
> www.inmotionhosting.com/webdesign
> Answers to commonly asked questions, as well as other useful tools, can be
> found at http://support.inmotionhosting.com
>
> How am I doing? Please feel free to email my manager at
> manager_feedback@...otion.net
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/