Comment by mickrussom | Hacker News Reader

Comment by mickrussom | Hacker News Reader

Parent Full thread

Nice , glad he got paid. Whats truly sad is they did try to chisel him out of his bounty if you read the timeline, he had to prod them to get his bounty. Can any of these top-ten companies that make like 200 million per day (google/alphabet, amazon, microsoft) ever do anything in good faith? One time google stiffed me initially on an RMA with a nexus phone until I stamped my feet a bit complaining that a company that makes 200M/day is stiffing me, the loyal android lover, for a $200 hunk of chinese-made plastic. (and just a short while later with things like SafetyNet I can no longer have root on an $800 pixel that isnt even waterproof). So much for dont be evil. Well, they dropped that in favor of -"do the right thing—follow the law, act honorably, and treat each other with respect" yeah, they can respectably be cheap chiseling money grubbers as long as its legal - like helping locate Falun Gong members in China. And the corporate stewardship -in the hands of the employees - they get blinded by the huge pay and instantly fail to see the bad things that go on. Anyways, glad he got paid. Amazing that a company with 57000 employees (and TONS of contractors, they dont want more employees who get benefits and stock when they can string contractors along) needs some random guy to find holes in the back door.

I wish I could flag this.

There's invariably one comment like this on bug bounty stories here. One comment that isn't happy with the bug bounty result even when the researcher is and goes off the rails with a weird anti-large company bias and some conspiracy.

This has absolutely nothing to do with your Nexus RMA story, or your cloud SLA story from downthread, or whatever other agenda you have against these large companies.

Do you have any concept of it's like to run a bug bounty at Google's size? Have you ever been involved in managing one? Have you ever participated in one? Can you qualify any of your opinion with something aside from these irrelevant grievances you're throwing out?

You're not contributing to the discussion at all, you're just hijacking the thread so you can perpetuate your soapbox. Human beings make mistakes and bug bounties are an easy place to drop the ball. No one is trying to cheat security researchers out of their rewards.

Some companies do worse than attempt to cheat people out of rewards: they threaten to sue them. But Google doesn't do that.

I find it much more likely that they just dropped the ball on paying them, rather than maliciously trying to deny them a bounty.

Try arguing with them about an SLA violation they had with their cloud infrastructure. The game is setup where they can chisel and have these guffaw and aw garsh moments but every adword and every billable second on their cloud will get paid hell or high water.

Did you seriously come to hijack a story about a Google bug bounty so you could complain about an irrelevant issue?

If I'm being completely fair, how often does HN as a whole discuss related topics or cases in the comment thread? The best example is probably that people kept mentioning Reader shutting down whenever they launched something new, a la "not going to use this, see what they did to Reader".

Not sure it's entirely the same as this case, but hijacking threads with "remember when this happened?" is not that unique.

Sounds like everyone got what they wanted.

Also sounds like you were dealing with humans, who (before escalating) followed company protocols.

Also seems not too far-fetched that those protocols are in place to weed out the whatever% that make bogus claims.

All in all, nothing I'd call "truly sad", "evil" and whatnot. Just big businesses being big businesses.

Curious why you have such high tolerance for this type of behavior, since it appears that you don't actually approve of it.

I can't speak for the parent, but I have a tolerance for it because I've actually managed bug bounty programs; I also know Google receives on the order of 100,000 bug bounty reports annually, while a full order of magnitude less are actually valid.

Similar. Experience tought me that having patience for bad situations leads to more understanding and easier solving of issues.

The fact is that the more people are involved in a process, the slower the cogs turn.

Having patience is more of a defense mechanism than it is anything else. It has served me well and made life easier!

Reply on news.ycombinator.com