I for one am glad that Homakov decided to share and write about these security issues rather than just selling it to the highest bidder. I have learned quite a bit over the past year. And it's deplorable that Github isn't paying anything.
how much would someone pay for this vuln? We can discuss it... homakov@gmail.com
He can likely get compensated much, much better for an original 0day on a big site.
For example, when you negotiate your annual raise, your best alternative is the raise you could get by moving to another employer (adjusted for benefits, time spent commuting, how fun the job is etc). You don't have to explicitly say to your boss "give me a raise or I'll quit" - your boss just needs to know your options are open.
If homakov publicly says he'd never consider selling an exploit, he's saying his BATNA is $0 and some kudos on Hacker News. If he says he's undecided, his BATNA would be somewhere between a few thousand and a few hundred thousand dollars. Needless to say, the former statement closes off a lot of negotiation options while the latter leaves them open.
[0] http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin...
Hey, anyone, is github that super profitable company with 100mln investments ? They got no money or what?