Security Researchers Rewarded With $12.50 Voucher To Buy Yahoo T-Shirt 138
Hugh Pickens DOT Com writes "More and more companies are offering Bug Bounty Programs remunerating security researchers for reporting vulnerabilities and weaknesses in their applications and software. Now Security analyst Graham Cluley writes that researchers at High-Tech Bridge informed Yahoo's Security Team about three cross-site scripting (XSS) vulnerabilities affecting the ecom.yahoo.com and adserver.yahoo.com domains. According to High-Tech Bridge, each of the vulnerabilities could compromise *any* @yahoo.com email account. All that was required was that the victim, while logged into Yahoo, should click on a specially-crafted link received in an email. Forty-eight hours later, Yahoo had patched all of the vulnerabilities and Yahoo's security team responded, thanking the researchers and 'offering the mighty bounty of err.. $12.50 per vulnerability,' writes Cluley. But there was one catch. The $12.50 was given as a discount code that can only be used in the Yahoo Company Store, which sells Yahoo's corporate t-shirts, cups, pens and other accessories."
So . . . (Score:2)
Re:So . . . (Score:5, Funny)
Have you seen the new Yahoo logo?
Re: (Score:2)
Re: (Score:2)
"Have you seen the new Yahoo logo?
That's smart... see the uninspired, shallow people jumping the ship soon."
Seriously, its a silly logo and all that jazz, but wouldn't you leave a company because it no longer the right employer? *
* Where right_employer = (pay && boss && peers && benefits && work_conditions && commute && ! good_self_employment_prospects)
And not because the logo was terrible?
Re:So . . . (Score:5, Funny)
Surely they sell a T-shirt that reads "I saved Yahoo! public embarrasement, millions of dollars in damages and all I got was this lousy T-shirt".
Re: (Score:2)
Re: (Score:1)
No, they didn't bail them out of anything. Yahoo is in the middle of their "hey, lets recycle old user email names that haven't been logged into recently. what could go wrong?" debacle.
Re:So . . . (Score:4, Funny)
Recycling email addresses is a great time saver. It saved me the hassle of getting myself on spam and porn lists. If not for Yahoo's decision my grandmother would never have discovered the delights of European bestiality. It also meant I didn't have to go making accounts on other services, as I just waiting for newsletters and other mailings to come through so I could use them to reset the passwords of the prior owner.
Top notch idea! I wish Yahoo would make a computer. I know they'd add useful features, such as the "decrypt hard drive" button on the back for those awkward moments when someone has files I really need to see.
Re: (Score:2)
Re: (Score:3, Funny)
There weren't any in XXL.
Comment removed (Score:5, Funny)
Re:So . . . (Score:5, Insightful)
At least Yahoo! thanked them explicitly and didn't threaten to sue them.
Comment removed (Score:5, Informative)
Re: (Score:3, Interesting)
Re: (Score:1)
Re: (Score:2)
Used to posting as AC, all my formatting was lost, hence the wall of text. internet n00b in 2013 FTW?
Heh heh. You just arrived from AOL?
I get your power-line story. I agree there shouldn't be a sense of self-entitlement for doing the right thing. To continue with that story, what Yahoo did would be comparable to the electrical company swinging by your place afterwards with a voucher entitling you to pay 5 dollars to come ride in the van on their way back to the depot. Where there's no budget for a decent reward, it's better to go with either a polite thanks. Yahoo provided a reward that requires the recipi
Re: (Score:3)
Put it this way:
If folks despise a company, some who would otherwise help them will decline to, and others who would otherwise ignore them will act to harm them. Perhaps you don't think people *should* act that way, but they *do*. And I'm not at all certain that this isn't reasonable. I tend to help my friends in preference to helping strangers, and I'd be quite reluctant to help someone who had spit in my face. That I wouldn't give him a faceful of knuckles says more about my being a rather passive per
Re:So . . . (Score:4, Insightful)
If you contacted me and reported a bug in fakeroot-ng [lingnu.com] or rsyncrypto [lingnu.com], I'd fix it. I'd do it for free. I'll say "thank you" for reporting it.
If you contacted me with the precise same bug, and offered to pay me $1000 to fix it, I'd take your money and fix it as soon as I could, because I believe it is okay for FOSS developers to make money from their work.
If you contacted me and offered to pay me $10, I'd probably be offended.* If you can't afford to pay me a reasonable fee for my time, then ask me nicely to volunteer it. Do not, however, presume to pay me an unreasonable fee for it. There are things I'd happily do for free that I will simply refuse to do for a reward that is demeaning.
Shachar
* - If you waited for me to fix it, and then contributed $10 to my pay pal account, I'd not only say "thank you", I'd even happily tell everyone I know that someone did it. $10 makes for a lousy paycheck, but it's a perfectly reasonable donation.
Re: (Score:2)
This is news? (Score:4, Insightful)
They had many choices, simple two choices: Report bug and get $12.50, amazing yahoo was not giving them tree fidy.
They could have gone onto some darknets and sold the report for $100,000+. The choice was theirs to make.
Re:This is news? (Score:5, Insightful)
They had many choices, simple two choices: Report bug and get $12.50, amazing yahoo was not giving them tree fidy. They could have gone onto some darknets and sold the report for $100,000+. The choice was theirs to make.
Which is exactly why Yahoo should have paid them more. Make the choice less obvious and save themselves a lot of grief further down the line.
Re:This is news? (Score:5, Insightful)
Or paid them nothing. A small material reward is often more insulting than no reward but having done the right thing.
Re:This is news? (Score:5, Insightful)
When a diner doesn't leave a tip the waiter can reason "Maybe they forgot".
Now when the diner leaves a nickel on the table....
Re:This is news? (Score:4, Insightful)
Re:This is news? (Score:5, Insightful)
Absolutely.
When I worked in McJail, the grease trap exploded on one of my night shifts. BLAM! Couldn't use the sinks, and (once it had all rained back down from the ceiling and flowed down the walls) the back-room was ankle deep in nasty. In order to get the place ship-shape for the morning, I took all the dirty equipment to the local gas station and jet-washed it on my own dime, after rolling in the grease trying to unblock the pipe with my bare hands. While the other two put the rest of the store in order and went home, I was still there three hours after the end of my shift, cleaning up the mess as fast as it could drip from my body.
The store manager gave me a warm and heart-felt thank-you, although she had the good sense to refrain from shaking my hand. Then she gave me a present. It was the free plastic pen that the plumber had given her.
From there on in, every time I was tempted to go above and beyond the call of duty, I thought of that pen. That was ten years ago, and I still have it somewhere as a reminder.
Re: (Score:1)
Wow you were quite the sucker at the time. It's a shame that we all need go learn the lesson that on average corporations and management don't really care about us. You're just another brick in the wall.
Re: This is news? (Score:1)
I think you learned a highly valuable lesson in only one "wasted" night of effort, one that takes other much less fortunate people a lifetime to learn with far, far greater disappointment on top at the end as well. If someone pays you $12/h they deserve no more than $12 worth. If someone pays you $150,000 p.a they naturally deserve reasonable reciprocation, but unless you get a reasonable cut of the profits or own the business .. always feel for that pen of yours in the pocket and consider if you are gettin
Re: (Score:2)
Quote from Farmer Boy (Laura Ingalls Wilder): "Keep you nickle; I can't make change."
Re:This is news? (Score:4, Insightful)
at my local OWASP chapter meeting some months ago, we did a show of hands about how many people had reported via the pay-for-security-bug middlemen organisations rather than contacting the vendor/website directly. About 30% put their hands up. I was quite astounded although, having been threatened legally myself when I was called in a bug found on an eComm website then I would no longer go directly to the owner of the system unless I had a contract in place already. The money is apparently quite good; so long as you don't care who is using the bug...
Re:This is news? (Score:4, Insightful)
Oh, for fuck's sake, this argument is just awful. "Well, people SHOULD pay protection money, because otherwise anyone with enough strength might break their legs."
This is mafia reasoning, and it's shameful that geeks are increasingly engaging in this sort of argument.
Guess what? I can also break into most people's houses and nick their stuff without getting caught. They have ground floor windows, old doors, &c. That doesn't mean they owe me anything for NOT doing that, nor for sending them unsolicited notices that it would be easy to take their stuff. Indeed, English law at least is comfortable with the idea that you never owe anything for unsolicited work, even if it's beneficial. No one was making these "hackers" do the work - they were either bored or wanted the notoriety.
Re: (Score:1)
Oh, for fuck's sake, this argument is just awful. "Well, people SHOULD pay protection money, because otherwise anyone with enough strength might break their legs."
Actually, companies SHOULD pay for proper security, be it their own staff, contractors or "independent" security researchers. Since nothing ever happens to these companies WHEN they expose customer information WHEN they get hacked I have no sympathy for them at all. If you act irresponsibly then you don't get to cry about the results.
Re: (Score:3)
I'm not sure what cognitive fault causes people to blame the victim, but it seems like a common thought process.
Yes, companies should take more care with data (or, more widely, people should stop putting their data in the hands of random private businesses).
No, that doesn't mean it's their fault when someone malicious takes the data.
No, protection money is never an acceptable demand.
Re:This is news? (Score:5, Insightful)
There is no cognitive fault, but instead, a conditioned, and, frankly, dangerous, view of software as protected by legal remedy. This idea has left us with shit software supported by careless organizations propagating paper-thin security already compromised by rafts of governments. A network is a dangerous place, and software and hardware should treat networks like the wild west when it comes to privacy/security.
On your other point, regarding "protection money," the reasoning is rather simple. People respond to incentives. If hackers have little to no financial reason to disclose a vulnerability to Yahoo, some may be motivated to find other ways to monetize their efforts. Forget legality/morality for a second and just think about incentives. What Yahoo is doing is removing their incentive for responsible disclosure. By providing a T-Shirt voucher, they're probably incentivizing attack by otherwise disinterested parties, just for the middle-finger of it all.
Re: (Score:2, Insightful)
Forget legality/morality for a second
No, that's an awful idea.
and just think about incentives.
My incentive is that I build a better society through responsible disclosure. Morality helps me reach that conclusion.
Re: (Score:1)
My incentive is that I build a better society through responsible disclosure. Morality helps me reach that conclusion.
That's you though with your morality. There are plenty of skilled people out there who don't care about building a better society or who have different moralities. There is no one "right" morality. I think your fallacy is believing that you hold a universal world view.
Re: (Score:2)
There are plenty of skilled people out there who don't care about building a better society or who have different moralities.
And they must be dealt with, not pandered to.
Re: (Score:2)
Sure, let me know how that works out for you.
Meanwhile there will be many, many people who are getting away with doing bad things because they are smart enough to figure out how to and hard enough to catch that they can get away with it for a long time, maybe forever.
And your morality is what fuels some of them, at least the "build a better society" part. See the thing is that security vulnerabilities need to be exploited in both high and low profile companies in order for those and other companies like the
Re: (Score:2)
Meanwhile there will be many, many people who are getting away with doing bad things because they are smart enough to figure out how to and hard enough to catch that they can get away with it for a long time, maybe forever.
Yup: murderers, rapists, robbers, fraudsters... why do we bother with all these laws when some smart enough people will get away with each of these crimes.
The very thing that you believe is good for society would be ignored or even punished if it weren't for the very real threat that is posed by people who exploit the vulnerabilities. You may think they're immoral or amoral for doing it but they're providing a very valuable service to society even as they harm it.
It wouldn't be a threat if there weren't people who wanted to exploit vulnerabilities. Circular argument, sigh.
You know what makes a strong immune system? Exposure to germs. Guess what makes a strong internet society?
You know what germs aren't? Human. Stop reducing humans to factors in a flawed model.
(And I say have to that repeatedly as a mathematician who has to put up with dumb economists.)
Re: (Score:2)
I don't suggest that people shouldn't be prosecuted when caught or that nobody should bother trying to catch them, I just expect you to be aware that with the internet, there is a far lower chance of getting caught and prosecution has very little deterrent effect. I'm not trying to say "don't bother" so much as "it obviously isn't working very well."
Re: (Score:3)
Think of it from another angle.
The money incentive is good enough of a reason to start researching. It's a matter of choice. between companies A, B and C, where A definitely offers a reward, B "might" offer you something crappy and C gives you the finger or even worse, sues you, WHAT would you choose? It's equally moral to research for all the above companies, and equally moral to provide them the results; I agree with that. But then, once the moral equality exists, you look at other parts of the deal, and
Re: (Score:2)
Erm, bounties aren't a good reason to start security research. "Bounty hunting" is in a primitive form of compensation which is usually supplanted by more stable, reliable arrangements for all parties.
If you're good at that sort of thing, you get a perm job, being paid the money Yahoo would allocate to employees rather than PR exercises.
I mean I think Yahoo has been pointless since before the turn of the millennium, but that's another matter...
Re: (Score:2)
Erm, bounties aren't a good reason to start security research
No, they're a good reason to pick which one to research, out of many options otherwise equal.
It's like this: I have a lawn mower, and in front of me there are three houses which need mowing. Should I pick the one where the owner gives me 10 bucks, the one where he gives me a "thanks" or the one where the guy chases me down the road with a shotgun, shooting salt pellets at my ass?
If you're good at that sort of thing, you get a perm job, being paid the money Yahoo would allocate to employees rather than PR exercises.
That's outside the scope of the conversation. Maybe you already have that job and are doing extra stuff for fun. Fun is in all cas
Re: (Score:1)
Yahoo has ensured that the next time someone finds a vulnerability in their webpage, it will go up for sale only to criminal organizations. You can argue until you're blue in the face about what should be, but that doesn't have an impact on what is.
Re: (Score:2)
Just because you're a cunt, it doesn't mean everyone who finds a vulnerability is.
Re: (Score:2)
No, as P.T.Barnum is supposed to have said "There's a sucker born every minute."
And it doesn't take "everyone who finds a vulnerability". It just takes one, as long as the others aren't motivated to report it "responsibly". (I wouldn't bother to report it if after the bother of dealing with lots of idiots and paperwork, the only reward was $13 off and advertisement for the company I was trying to help. And that's what they offered. I bet they still make a profit if the t-shirt is sold.)
Re: (Score:2)
There are more ways to pay for vulnerability data than just money.
I was once the in-company contact point for those matters at Check Point. Check Point did not (I'm not sure whether they do today) offer bounties or any other monetary rewards. That was okay, because that was a well advertised policy.
I tried to make really really sure that whenever a researcher reported a vulnerability, they would get the only payment I could give - credit. Once someone reported a buffer overrun, and agreed to hold off publis
Re: (Score:1)
Re:This is news? (Score:5, Insightful)
I see it differently. In real life we pay for cops via taxes. Part of their job is to offer advice and even survey your home for ways that criminals might break in. It's part of the service.
The internet doesn't have cops, but it does have criminals. Fortunately there are good guys who are willing to report flaws when they see them. Unfortunately many companies react to this helpful advice by threatening to sue or even trying to have the white hat arrested. Bug bounties make it clear that the company sees reporting as a valuable service and intends to act swiftly on reported problems.
Bug bounties also encourage people to look for issues from the outside, which is apparently quite valuable since the people on the inside seem to miss them quite often.
Companies should pay bug bounties when the issue is security, not as a kind of protection money but as a way of saying they take security seriously and wish to reward those who help them with it.
Re: (Score:2)
The internet doesn't have cops
Erm, yes it does. Law enforcement are as aware of the Internet as anything else. Perhaps they misallocate resources, and perhaps that's what you need to concentrate on fixing.
Unfortunately many companies react to this helpful advice by threatening to sue or even trying to have the white hat arrested.
Anonymous reporting is easy. If you attach your name to a public report then you're really using the threat of crime for personal profit. Try not to think about it from the PoV of the ego of the hacker.
Companies should pay bug bounties when the issue is security
They're welcome to offer them, although it's really more a PR thing "We're already so secure that we only expect to pay out a small amo
Re: (Score:2)
The internet doesn't have cops
Erm, yes it does. Law enforcement are as aware of the Internet as anything else. Perhaps they misallocate resources, and perhaps that's what you need to concentrate on fixing.
Yes, to a degree, but no matter how well funded and technically capable law enforcement is, try going down to the local police station and get them to care that somebody set up a XSS attack on your web sight and the script in question seems to be located in eastern Europe, but you think the original attacker may be somewhere in south-east Asia and they've used some of your costumer accounts to send some spam email.
Anonymous reporting is easy....
Agreed, but I don't see why it should be a necessity. Though starting a bug report with "I am
Re: (Score:2)
No, sir. Their job is to collect evidence of a crime. Their job is not to protect and serve. Their job is to send the bad guys to jail
Re: (Score:2)
Actually, their job is to protect the government. To do this they are allowed to enforce the laws, and several other things. This is basically PR and economics. (A safe environment is generally more profitable, which means it pays more taxes.) And if they observe a major crime (felony) they are supposed to try to arrest the perpetrator. Misdeameanors are optional. They can arrest, or warn, or even ignore.
And I'm talking about honest cops. There are all to many who don't measure up to that. And the "
Re: (Score:3, Informative)
"I see it differently. In real life we pay for cops via taxes. Part of their job is to offer advice and even survey your home for ways that criminals might break in. It's part of the service."
What utopia is that that you live in? Because here in the USA they do not do this at all. The police advice to me is, "do not own a weapon, in the case of a home invasion hide under your bed and call the police. Do not fortify your doors and windows as that is a crime."
Yes, Fortification of doors and windows in th
Re: (Score:2)
That's why the US is a shitty hell hole where you have to own a gun just to live in some kind of relative safety where you are still far more likely to be murdered than anywhere in western Europe. Apparently it's a police state too.
Re: (Score:2)
Okalahoma, Michigan, Wisconsin, Illinois all have laws on the books to make home fortification illegal. I am certain there are more out there.
Re: (Score:2)
>
> In real life we pay for cops via taxes. Part of their job is to offer advice and even survey your home for ways that criminals might break in. It's part of the service.
>
Where are you located? I've never heard of public cops giving home inspections. I've had ADT,etc... give advice (i.e. try to sell me stuff)
and I've even had landscapers give advice (again, try to sell me on work), but I've never heard of public cops giving home audits.
The only home audits I've heard of in the USA are energy au
Re: (Score:2)
I'm not sure what cognitive fault causes people to blame the victim, but it seems like a common thought process.
It's a disturbingly common thought process that is most disturbingly used in sex-related instances, such as unplanned pregnancy and sexual assault.
People don't want to accept that bad things can happen pretty randomly to good and well prepared people, so it's more comforting to assume the just world hypothesis. People get what they deserve, and as I'm a good person I'll surely be safer.
Re: (Score:2)
Well summarised.
Re: (Score:2)
Cheers, sir/madam.
Re: (Score:2)
The guy who merely tells you is not a racketeer.
The guy who threatens to commit a crime against you if you don't pay him money IS a racketeer.
Re: (Score:2)
Do you have any proof whatsoever that the security researchers in question made such demands?
No?
Then lay off the ad hominums and red herrings.
Re: (Score:2)
I'm railing against the idiot commenters who believe that such threats - overt or veiled - are a valid way to go about business.
Re: (Score:2)
Oh, for fuck's sake, this argument is just awful. "Well, people SHOULD pay protection money, because otherwise anyone with enough strength might break their legs."
You must be a philosopher, because your analysis, and the course of action that you derive from it, is only valid in a possible world that we don't live in. In the real world, society incurs expenses all the time to protect itself from malicious parties. Last time I bought a car, they were still putting locks on them. If you want to get worked up over this, you should start with the defense budget of the nation you live in.
Re: (Score:1)
Re: (Score:2)
http://news.yahoo.com/yahoo-ceo-ranked-2nd-companys-2012-pay-scale-001129756.html [yahoo.com]
Regulatory documents filed Tuesday revealed that Mayer received a pay package valued at $36.6 million last year. Most of the compensation consisted of stock awards that Mayer got in July when she ended a 13-year stint as a top Google executive to become Yahoo's CEO.
Most of the components of Mayer's pay had been previously disclosed.
It wasn't previously known that Mayer ranked second on Yahoo Inc.'s pay scale last year.
Henrique
Why do people still do this anymore? (Score:1)
Don't you know that security vulnerabilities go into the NSA arsenal before they are fixed? Why do you still do "responsible disclosure"? Why do you work with the vendors at all? Security vulnerabilities are valuable, but you're propping up a corrupt system and get only peanuts in return, if anything. The NSA does not have moral hangups about their war on the internet. They use what you give them to undermine any and all security protocols. The only problem that companies like Yahoo have with cooperating is
Re: Why do people still do this anymore? (Score:2)
No, really, aside words an speaches made as if you're wearing a V mask.
Re: (Score:1, Insightful)
Sell them.
Re: (Score:1)
In which case the buyer might just be a straw man for the NSA.
So your choice basically is: Tell the company and risk that the NSA gets it as well, or sell it and risk that only the NSA gets it. Now, which one is more responsible?
Re: (Score:1)
Well, you still have it. It's a vulnerability, not a teddy bear.
Re: Why do people still do this anymore? (Score:2)
Re: (Score:3, Informative)
Which part of "Forty-eight hours later, Yahoo had patched all of the vulnerabilities" did you miss?
If you want to object here, then get that tinfoil hat straight and get some sharper Occam's razor.
Seriously, if you think "bug reported to Yahoo -> NSA demands it from Yahoo -> NSA quickly uses it to hack Yahoo's accounts in 2 days -> Yahoo patches it" is realistic, then you should realize that "NSA demands access to Yahoo accounts -> NSA leisurely browses through all Yahoo accounts they want" woul
They must have an exclusive store (Score:5, Funny)
With the tshirt that says "I found a vulnerability and all I got was this lousy T-Shirt"
Re: (Score:1)
With the tshirt that says "I found a vulnerability and all I got was this lousy T-Shirt"
Or a T-shirt which says "I found a bug and all I got was this lousy mug".
Re:They must have an exclusive store (Score:4, Interesting)
Re: (Score:1)
They'll also send a W2.
Wait! (Score:1)
And you call yourselves geeks... Ahahahaha!
Re: (Score:1)
See? No trailing space. I learned MY lesson. You should google humor in general, irony in particular.
Better idea (Score:1)
Better than Microsoft (rember this story?) (Score:3, Interesting)
When Microsoft lost their Hotmail domain name, some guy snatched it and kindly returned it to Microsoft because he thought it was the right thing to do, to protect Microsoft from their stupidity. Well, Microsoft sent him a personal thank you note and that was all. Yep, the guy could have legally resold the domain for like a billion dollars (wouldn't be the first time.. ahem, live.com) and gotten away with it. All he got was a lousy certificate of gratitude.
Re: (Score:3, Informative)
You mean this guy [doublewide.net] who got a cheque for $500 and a bunch of software for a problem that took him 2 minutes and $35 to address?
Re: (Score:2)
All he got was a lousy certificate of gratitude.
Maybe all the people using hotmail could pony-up $2.00 for the guy. After all, they are the ones who would really be affected should the domain be sold.
Re: (Score:2)
If he kept the domain, then MS would have sued him.
Not bad (Score:5, Funny)
C'mon. This is WAY better than the Standard Operation Practice: suing them into the ground.
We're moving forward, it seems.
That seems fine (Score:2)
Re: (Score:2)
There was no expectation in the beginning except to get the problem solved, and that's what happened. Do you want them to hold the vulnerabilities for ransom or something?
Well... they didn't have to hold them for ransom; they could very well have taken the vulnerability to various dark spots on the internet and marketed it. I imagine, they could easily get a few hundred K selling a vulnerability like that on the open market.
Re: (Score:2)
Re: (Score:2)
Could you point me towards more information on this? I like the sound of this "sell out my neighbours on ebay" plan. Not all my neighbours, mind you, just one in particular.
Re: (Score:2)
Could you point me towards more information on this? I like the sound of this "sell out my neighbours on ebay" plan. Not all my neighbours, mind you, just one in particular.
Well, we like to be discrete so we do these exchanges in person, you see. So, I'll just need your address to get started. Oh, and I'm afraid I have terrible pet-dander allergies. Have you any bunnies, doggies, kitties, or other pets? The schedule's a bit busy this time of year (pre-Christmas rush), so what times are you available in the evenings for us to meet?
It's not Yahoo's work. (Score:1)
Why do you think that if someone finds a vulnerability in Yahoo's stuff their efforts now belong to Yahoo? What if the person just doesn't want to give it to Yahoo? Do you think that their work should be taken from them summarily? Maybe in the future, only those willing and able to sell the vulnerability to scammers and criminals will be the ones looking because the others had to find some other work that pays bills.
Motivation (Score:1)
I think Yahoo acted correctly in this case. I think paying people to much for bugs will distort the security landscape. The reason is security is an issue about the common good. No vulnerability is good... even if it is in your competitors products. We should have a culture of assisting with security issues without expecting money for it.
What will we have? People selling vulnerabilities to the highest bidder which is socially acceptable? Note that the word here is social, NOT commercial.
Of course security
Re: (Score:2)
No. White hat hackers will just generall ignore Yahoo. What Yahoo will get is various shades from darkish grey to black, and the shades of grey will have just gotten a bit darker.
Better to give nothing (Score:3)
Wow. That's all kind of fail. It would be better for Yahoo to state as a matter of policy that they don't pay bounties. You might disagree with that; but at least you'd respect it. What they did instead is the equivalent of leaving a nickel tip at a restaurant. Giving nothing makes you look cheap, careless or unaware of tipping customs. Giving the nickel says, "yes, I know I should tip, here's what I think you're worth".
How sneaky (Score:1)
Alternative? (Score:1)
A T-shirt or something...
Hey! It's better than getting sued!
(As has happened before.)
Re: (Score:2)
But that is the whole point, Yahoo hasn't got a monopoly because they aren't the only interested party.
Next time, the researchers (not just these guys, but researchers in general) are going to ask why they should give Yahoo first bid when they know it's going to lead to nothing but an insult for their efforts.
Re: (Score:3)
The vouchers are traceable. The REAL reward is coming AFTER the winner or researcher tries to claim it or use it at the store. Supply your own ending e.g. Congratulations, here's your new office...
Re: (Score:2)
It sure doesn't need to be an insult. A $13 voucher that can only be spent to advertise the company...that's an insult.