full-disclosure - Re: Serious Yahoo bug discovered. Researchers rewarded with $12.50

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAFz=D_dKc+TniaKJtP5cxxQVbz5Hq6Ntg_eGF5oxVWf6zGBWuQ@mail.gmail.com>
Date: Wed, 2 Oct 2013 12:31:55 -0400
From: Brandon Whaley <brandonw@...otionhosting.com>
To: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Serious Yahoo bug discovered. Researchers
 rewarded with $12.50

I think the point is not so much that $12.50 is a trivial sum to receive,
but that if one were to sell a useful exploit to nefarious entities, one
would make significantly more.  The point of bug bounties is to reduce the
financial disparity between responsible reporting and selling it to people
who'd abuse it.

On Wed, Oct 2, 2013 at 11:48 AM, Justin Ferguson <jf@...co.net> wrote:

> not that its a fair payout, but for the sake of accuracy, wasnt this
> actually $12.50 per XSS? Of those he turned in, how many were
> legitimate threats? I haven't paid any attention to it-- bug bounties
> are not economically viable for a person to make a living on
> irrelevant of the payout.
>
> On Wed, Oct 2, 2013 at 11:32 AM, Ian Hayes <cthulhucalling@...il.com>
> wrote:
> >
> >
> >
> > On Wed, Oct 2, 2013 at 8:20 AM, Jordon Bedwell <envygeeks@...il.com>
> wrote:
> >>
> >> On Wed, Oct 2, 2013 at 10:19 AM, Ian Hayes <cthulhucalling@...il.com>
> >> wrote:
> >> > Paint it for us, o wise philosopher.
> >>
> >> Figure it out, I'm not your mother, I'm not here to teach you how humans
> >> behave.
> >
> >
> > Sounds like someone has an overdeveloped sense of self-entitlement.
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

-- 
Best Regards,
Brandon W.
Tier 3 System Administrator
InMotion Hosting Inc.

888-321-4678
757-416-6575 (Int'l)
NEW: 24x7 EMAIL and PHONE Technical Support

Did you know?
We'll Build, Update and Promote Your Site for You! Visit
www.inmotionhosting.com/webdesign
Answers to commonly asked questions, as well as other useful tools, can be
found at http://support.inmotionhosting.com

How am I doing? Please feel free to email my manager at
manager_feedback@...otion.net

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/