Hacker News Reader

Comment by Zirro | Hacker News Reader

According to this[1] article about the current issue:

"Before releasing this information, Hall emailed Yahoo and tweeted at its engineering team and CEO Marissa Mayer.

It was confirmed to him that its servers had been infiltrated but Yahoo refused to pay him for alerting them as it was not part of the company’s bug bounty programme."

[1]: http://www.independent.co.uk/life-style/gadgets-and-tech/new...

EDIT: The quote previously included "Yahoo is notorious for its disregard of bug bounty hunters, having last year rewarded one such hacker who identified three bugs in Yahoo's servers with a $25 voucher for company merchandise." but I moved it here as it caused confusion regarding which issue the article was referencing.

View on HN

Please read the follow up:

http://yahoodevelopers.tumblr.com/post/62953984019/so-im-the...

(and HN discussion: https://news.ycombinator.com/item?id=6488897)

That article is poorly reported. Yahoo didn't have a bug bounty program at all at that time. And their response was blown totally out of proportion.

They keep insulting bounty hunters like that, they'll end up on the wrong side of black market bug trades every time some new exploit comes up. And I won't be defending Yahoo when that happens.

Are these people concerned with security or are they running a protection racket? The way you put it is starting to sound like the latter.

This has nothing to do with "protection racket" and downvoters are going to be in for one hell of a reality check if you don't believe that this will happen.

Bounty hunters do this stuff for a living. If the company pays with $25 vouchers and the black market pays on the order of tens/hundreds of thousands, who do you think "these people" will go to?

I frankly don't believe you. I think you vastly overestimate how much you can sell a vulnerability for and vastly underestimate the morals of white hat hackers reporting bugs for a bounty.

There are close to zero companies that pay tens/hundreds of thousands for a bug, and yet clearly bounties are being paid and not 100% of bugs end up on the black market.

Mitnicks security company recently started a vulnerability marketplace. For vulnerabilities that meet the criteria (they have to be of a certain severity, not already known, etc), they are sold for a minimum of $100,000.

Microsoft will pay up to $100,000 plus $50,000 bonus for defense submissions (http://technet.microsoft.com/en-us/security/dn425049)

Facebook has paid $12,500 for one (http://techcrunch.com/2013/09/02/security-researcher-discove...)

Google will pay up to $20,000 for one (http://www.google.com/about/appsecurity/reward-program/#rewa...)

Forbes even posted an article a couple years ago on the market of zero day exploits and listed prices someone could get for zero day exploits with prices in the tens/hundreds of thousands. (http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin...) It should be noted that they state in this article that the groups that will buy these exploits for these prices are generally western governments.

Yes, the market for security vulnerabilities is essentially a protection racket, and everyone knows it.

I'd say: "Are these people concerned with receiving income for difficult, highly specialized, valuable work, or are they running a charity?" I guess it's a matter of perspective.

Not really. We have a system for ensuring that people get paid for valuable work: they're called contracts.

Reply on news.ycombinator.com