Hacker News Reader

Comment by sneak | Hacker News Reader

The bounty amount seems exceptionally low in light of the experience of the reporter, the security budget of the reportee, and the severity of the bug.

It seems to me another zero on the end would be appropriate.

View on HN

Not to mention his extremely well founded comments on their patch.

High level consulting basically.

Fifteen thousand dollars to report a bug in a PAM module that you need a local account to exploit? That is excessive. I don't think a professional would get paid that much for an audit of the project (and they didn't hire one, this just one bug report)

$15k sounds about on the money for the consulting project to assess pam-ussh. But I agree that it's a silly amount for a bounty.

The actual bounty was $1,500, not $15,000: https://hackerone.com/reports/204802#activity-1513764

Yes. The parent-parent said "It seems to me another zero on the end would be appropriate. "

Perhaps one day I'll learn to read. Sorry 'bout that.

The public release of the report (where the bounty hunter talks extensively about the right and wrong ways to fix the issue) is a nice feather to put in your cap, even if the cash is not a lot.

Ah, the old "do-it-for-the-publicity" :)

What severity? It's an internal-only bug. There is literally no conceivable market for it.

I don't think Solar Designer even expected a bounty.

It's public code, for a PAM module that others might be using too. The attack isn't limited to Uber's infrastructure.

To the extent this is true, those others aren't paying the bounty. Uber, who is paying, probably has fairly limited exposure to the bug; i.e. one insider impersonating another. To return to the main point, who exactly would pay more for this bug and why?

Reply on news.ycombinator.com