Forgot your password?
typodupeerror
Security Yahoo!

Security Researchers Rewarded With $12.50 Voucher To Buy Yahoo T-Shirt 138

Posted by Unknown Lamer
from the gimme-more-or-ill-hack-ur-serverz dept.
Hugh Pickens DOT Com writes "More and more companies are offering Bug Bounty Programs remunerating security researchers for reporting vulnerabilities and weaknesses in their applications and software. Now Security analyst Graham Cluley writes that researchers at High-Tech Bridge informed Yahoo's Security Team about three cross-site scripting (XSS) vulnerabilities affecting the ecom.yahoo.com and adserver.yahoo.com domains. According to High-Tech Bridge, each of the vulnerabilities could compromise *any* @yahoo.com email account. All that was required was that the victim, while logged into Yahoo, should click on a specially-crafted link received in an email. Forty-eight hours later, Yahoo had patched all of the vulnerabilities and Yahoo's security team responded, thanking the researchers and 'offering the mighty bounty of err.. $12.50 per vulnerability,' writes Cluley. But there was one catch. The $12.50 was given as a discount code that can only be used in the Yahoo Company Store, which sells Yahoo's corporate t-shirts, cups, pens and other accessories."
This discussion has been archived. No new comments can be posted.

Security Researchers Rewarded With $12.50 Voucher To Buy Yahoo T-Shirt

Comments Filter:
  • What's the problem? :P
    • Re:So . . . (Score:5, Funny)

      by kthreadd (1558445) on Tuesday October 01, 2013 @04:20AM (#44999813)

      Have you seen the new Yahoo logo?

      • Yahoo with its new zipper logo strikes me as one of those parking pages that serves lame, untargeted ads.

    • Re:So . . . (Score:5, Funny)

      by mwvdlee (775178) on Tuesday October 01, 2013 @04:21AM (#44999817) Homepage

      Surely they sell a T-shirt that reads "I saved Yahoo! public embarrasement, millions of dollars in damages and all I got was this lousy T-shirt".

      • Considering how many Yahoo accounts I know that got hacked (probably double digit percentages of all that exist), they didn't necessarily "save" them from anything. They "bailed them out of a class 5 shitstorm" maybe.
        • No, they didn't bail them out of anything. Yahoo is in the middle of their "hey, lets recycle old user email names that haven't been logged into recently. what could go wrong?" debacle.

          • Re:So . . . (Score:4, Funny)

            by MysteriousPreacher (702266) on Tuesday October 01, 2013 @04:08PM (#45006599) Journal

            Recycling email addresses is a great time saver. It saved me the hassle of getting myself on spam and porn lists. If not for Yahoo's decision my grandmother would never have discovered the delights of European bestiality. It also meant I didn't have to go making accounts on other services, as I just waiting for newsletters and other mailings to come through so I could use them to reset the passwords of the prior owner.

            Top notch idea! I wish Yahoo would make a computer. I know they'd add useful features, such as the "decrypt hard drive" button on the back for those awkward moments when someone has files I really need to see.

      • by idontgno (624372)
        Depending on the T-shirt [yahoo.com], the slogal might have to say "I saved Yahoo! public embarrasement and millions of dollars in damages, and all I got was a discount on this lousy T-shirt." to be perfectly accurate.
    • Re: (Score:3, Funny)

      by Anonymous Coward

      There weren't any in XXL.

    • Re:So . . . (Score:5, Funny)

      by squiggleslash (241428) on Tuesday October 01, 2013 @07:32AM (#45000757) Homepage Journal
      I know, at least Yahoo! didn't insult them by offering them a job at Yahoo! or something...
    • Re:So . . . (Score:5, Informative)

      by hairyfeet (841228) <bassbeast1968.gmail@com> on Tuesday October 01, 2013 @10:38AM (#45002595) Journal

      The problem is that Yahoo just sent out a message to every grey hat, letting them know "if you want anything other than a T-Shirt talk to the metasploit guys" and ya know what? they will. Its not just about the money, its about respect. A t-shirt is the kind of prize you get from some DJ standing on a street corner NOT what you get for saving a company endless bad press and possible millions in pissed off users.

      Of course the real bitch isn't just the XSS, its when you mix that with an insecure browser you get a real perfect shitstorm. See my journal for what I labeled the "Yahoo porn bug" a couple years back, if you take Yahoo and ONLY Yahoo, didn't see this with either Gmail nor Live mail, and Firefox which again ONLY FF, not any of the Chromium or Webkit browsers nor Opera nor IE, put them together and what do you get? you get the ability for spammers to be able to spam entire address books without having any real access at all. They do this by using the fact that FF runs at the same permission levels as the user (which is retarded but Moz refuses to fix, Chromium had the ability to run below user permission more than 6 years ago) and with a hidden iFrame and using the FF auto login (or even just a still valid cookie) they could have access to the entire address book without having to break into the account or even send a drop of data back to themselves.

      So as I've been saying for a few years now yahoo really needs to get their shit together, its entirely too easy to use Yahoo email addresses for spamming. The same can be said of Moz, I no longer include any gecko based browsers specifically because they refuse to add low rights mode. Bad security practices are bad practices and insulting those that find bugs by giving them a lousy $12.50 t-shirt? They have made sure the next bug found by a grey hat will only be found out by Yahoo when they are getting pwned.

      • Re: (Score:3, Interesting)

        After lurking on slashdot for the last 10 years, this post finally got me to set up an account. Woo! It's my ... well, you know. The hypothesis here is that yahoo didn't pay for the exploits, so obviously grey hats will go to the black market. Further, it's ethically justified because of the slap in the face. I think if you tell a private company that they have a security problem, and they thank you, you can pat yourself on the back. If you're doing it specifically for money, then don't spend your time on
        • Used to posting as AC, all my formatting was lost, hence the wall of text. internet n00b in 2013 FTW?
          • Used to posting as AC, all my formatting was lost, hence the wall of text. internet n00b in 2013 FTW?

            Heh heh. You just arrived from AOL?

            I get your power-line story. I agree there shouldn't be a sense of self-entitlement for doing the right thing. To continue with that story, what Yahoo did would be comparable to the electrical company swinging by your place afterwards with a voucher entitling you to pay 5 dollars to come ride in the van on their way back to the depot. Where there's no budget for a decent reward, it's better to go with either a polite thanks. Yahoo provided a reward that requires the recipi

        • by HiThere (15173)

          Put it this way:
          If folks despise a company, some who would otherwise help them will decline to, and others who would otherwise ignore them will act to harm them. Perhaps you don't think people *should* act that way, but they *do*. And I'm not at all certain that this isn't reasonable. I tend to help my friends in preference to helping strangers, and I'd be quite reluctant to help someone who had spit in my face. That I wouldn't give him a faceful of knuckles says more about my being a rather passive per

        • Re:So . . . (Score:4, Insightful)

          by Sun (104778) <shachar@shemesh.biz> on Wednesday October 02, 2013 @05:04AM (#45011799) Homepage

          If you contacted me and reported a bug in fakeroot-ng [lingnu.com] or rsyncrypto [lingnu.com], I'd fix it. I'd do it for free. I'll say "thank you" for reporting it.

          If you contacted me with the precise same bug, and offered to pay me $1000 to fix it, I'd take your money and fix it as soon as I could, because I believe it is okay for FOSS developers to make money from their work.

          If you contacted me and offered to pay me $10, I'd probably be offended.* If you can't afford to pay me a reasonable fee for my time, then ask me nicely to volunteer it. Do not, however, presume to pay me an unreasonable fee for it. There are things I'd happily do for free that I will simply refuse to do for a reward that is demeaning.

          Shachar

          * - If you waited for me to fix it, and then contributed $10 to my pay pal account, I'd not only say "thank you", I'd even happily tell everyone I know that someone did it. $10 makes for a lousy paycheck, but it's a perfectly reasonable donation.

        • by hairyfeet (841228)

          Its not about the money dude, you completely missed the point...its about showing respect. Do you REALLY think that 1337 check is more than those at Metasploit would pay? of course not but it shows that Google DOES appreciate the effort, its their way of saying "great job guys, thanks" and THAT COUNTS for a fricking LOT in this world.

          When yahoo gives them a fucking COUPON for a shirt they STILL have to pay part of, along with shipping and handling? Its clear the message is "We don't give a fuck about you,

  • This is news? (Score:4, Insightful)

    by Anonymous Coward on Tuesday October 01, 2013 @04:02AM (#44999739)

    They had many choices, simple two choices: Report bug and get $12.50, amazing yahoo was not giving them tree fidy.
      They could have gone onto some darknets and sold the report for $100,000+. The choice was theirs to make.

    • Re:This is news? (Score:5, Insightful)

      by Dexter Herbivore (1322345) on Tuesday October 01, 2013 @04:24AM (#44999835) Journal

      They had many choices, simple two choices: Report bug and get $12.50, amazing yahoo was not giving them tree fidy. They could have gone onto some darknets and sold the report for $100,000+. The choice was theirs to make.

      Which is exactly why Yahoo should have paid them more. Make the choice less obvious and save themselves a lot of grief further down the line.

      • Re:This is news? (Score:5, Insightful)

        by Sockatume (732728) on Tuesday October 01, 2013 @08:24AM (#45001079)

        Or paid them nothing. A small material reward is often more insulting than no reward but having done the right thing.

        • Re:This is news? (Score:5, Insightful)

          by CODiNE (27417) on Tuesday October 01, 2013 @11:00AM (#45002865) Homepage

          When a diner doesn't leave a tip the waiter can reason "Maybe they forgot".

          Now when the diner leaves a nickel on the table....

        • Re:This is news? (Score:5, Insightful)

          by 6Yankee (597075) on Tuesday October 01, 2013 @11:00AM (#45002873)

          Absolutely.

          When I worked in McJail, the grease trap exploded on one of my night shifts. BLAM! Couldn't use the sinks, and (once it had all rained back down from the ceiling and flowed down the walls) the back-room was ankle deep in nasty. In order to get the place ship-shape for the morning, I took all the dirty equipment to the local gas station and jet-washed it on my own dime, after rolling in the grease trying to unblock the pipe with my bare hands. While the other two put the rest of the store in order and went home, I was still there three hours after the end of my shift, cleaning up the mess as fast as it could drip from my body.

          The store manager gave me a warm and heart-felt thank-you, although she had the good sense to refrain from shaking my hand. Then she gave me a present. It was the free plastic pen that the plumber had given her.

          From there on in, every time I was tempted to go above and beyond the call of duty, I thought of that pen. That was ten years ago, and I still have it somewhere as a reminder.

          • by Anonymous Coward

            Wow you were quite the sucker at the time. It's a shame that we all need go learn the lesson that on average corporations and management don't really care about us. You're just another brick in the wall.

          • by Anonymous Coward

            I think you learned a highly valuable lesson in only one "wasted" night of effort, one that takes other much less fortunate people a lifetime to learn with far, far greater disappointment on top at the end as well. If someone pays you $12/h they deserve no more than $12 worth. If someone pays you $150,000 p.a they naturally deserve reasonable reciprocation, but unless you get a reasonable cut of the profits or own the business .. always feel for that pen of yours in the pocket and consider if you are gettin

        • by MickLinux (579158)

          Quote from Farmer Boy (Laura Ingalls Wilder): "Keep you nickle; I can't make change."

    • Re:This is news? (Score:4, Insightful)

      by rapiddescent (572442) on Tuesday October 01, 2013 @04:39AM (#44999903)

      at my local OWASP chapter meeting some months ago, we did a show of hands about how many people had reported via the pay-for-security-bug middlemen organisations rather than contacting the vendor/website directly. About 30% put their hands up. I was quite astounded although, having been threatened legally myself when I was called in a bug found on an eComm website then I would no longer go directly to the owner of the system unless I had a contract in place already. The money is apparently quite good; so long as you don't care who is using the bug...

    • Re:This is news? (Score:4, Insightful)

      by Joining Yet Again (2992179) on Tuesday October 01, 2013 @05:00AM (#45000009)

      Oh, for fuck's sake, this argument is just awful. "Well, people SHOULD pay protection money, because otherwise anyone with enough strength might break their legs."

      This is mafia reasoning, and it's shameful that geeks are increasingly engaging in this sort of argument.

      Guess what? I can also break into most people's houses and nick their stuff without getting caught. They have ground floor windows, old doors, &c. That doesn't mean they owe me anything for NOT doing that, nor for sending them unsolicited notices that it would be easy to take their stuff. Indeed, English law at least is comfortable with the idea that you never owe anything for unsolicited work, even if it's beneficial. No one was making these "hackers" do the work - they were either bored or wanted the notoriety.

      • by Anonymous Coward

        Oh, for fuck's sake, this argument is just awful. "Well, people SHOULD pay protection money, because otherwise anyone with enough strength might break their legs."

        Actually, companies SHOULD pay for proper security, be it their own staff, contractors or "independent" security researchers. Since nothing ever happens to these companies WHEN they expose customer information WHEN they get hacked I have no sympathy for them at all. If you act irresponsibly then you don't get to cry about the results.

        • I'm not sure what cognitive fault causes people to blame the victim, but it seems like a common thought process.

          Yes, companies should take more care with data (or, more widely, people should stop putting their data in the hands of random private businesses).

          No, that doesn't mean it's their fault when someone malicious takes the data.

          No, protection money is never an acceptable demand.

          • Re:This is news? (Score:5, Insightful)

            by chaboud (231590) on Tuesday October 01, 2013 @07:04AM (#45000589) Homepage Journal

            There is no cognitive fault, but instead, a conditioned, and, frankly, dangerous, view of software as protected by legal remedy. This idea has left us with shit software supported by careless organizations propagating paper-thin security already compromised by rafts of governments. A network is a dangerous place, and software and hardware should treat networks like the wild west when it comes to privacy/security.

            On your other point, regarding "protection money," the reasoning is rather simple. People respond to incentives. If hackers have little to no financial reason to disclose a vulnerability to Yahoo, some may be motivated to find other ways to monetize their efforts. Forget legality/morality for a second and just think about incentives. What Yahoo is doing is removing their incentive for responsible disclosure. By providing a T-Shirt voucher, they're probably incentivizing attack by otherwise disinterested parties, just for the middle-finger of it all.

            • Re: (Score:2, Insightful)

              Forget legality/morality for a second

              No, that's an awful idea.

              and just think about incentives.

              My incentive is that I build a better society through responsible disclosure. Morality helps me reach that conclusion.

              • My incentive is that I build a better society through responsible disclosure. Morality helps me reach that conclusion.

                That's you though with your morality. There are plenty of skilled people out there who don't care about building a better society or who have different moralities. There is no one "right" morality. I think your fallacy is believing that you hold a universal world view.

                • There are plenty of skilled people out there who don't care about building a better society or who have different moralities.

                  And they must be dealt with, not pandered to.

                  • by ancientt (569920)

                    Sure, let me know how that works out for you.

                    Meanwhile there will be many, many people who are getting away with doing bad things because they are smart enough to figure out how to and hard enough to catch that they can get away with it for a long time, maybe forever.

                    And your morality is what fuels some of them, at least the "build a better society" part. See the thing is that security vulnerabilities need to be exploited in both high and low profile companies in order for those and other companies like the

                    • Meanwhile there will be many, many people who are getting away with doing bad things because they are smart enough to figure out how to and hard enough to catch that they can get away with it for a long time, maybe forever.

                      Yup: murderers, rapists, robbers, fraudsters... why do we bother with all these laws when some smart enough people will get away with each of these crimes.

                      The very thing that you believe is good for society would be ignored or even punished if it weren't for the very real threat that is posed by people who exploit the vulnerabilities. You may think they're immoral or amoral for doing it but they're providing a very valuable service to society even as they harm it.

                      It wouldn't be a threat if there weren't people who wanted to exploit vulnerabilities. Circular argument, sigh.

                      You know what makes a strong immune system? Exposure to germs. Guess what makes a strong internet society?

                      You know what germs aren't? Human. Stop reducing humans to factors in a flawed model.

                      (And I say have to that repeatedly as a mathematician who has to put up with dumb economists.)

                    • by ancientt (569920)

                      Yup: murderers, rapists, robbers, fraudsters... why do we bother with all these laws when some smart enough people will get away with each of these crimes.

                      I don't suggest that people shouldn't be prosecuted when caught or that nobody should bother trying to catch them, I just expect you to be aware that with the internet, there is a far lower chance of getting caught and prosecution has very little deterrent effect. I'm not trying to say "don't bother" so much as "it obviously isn't working very well."

                      It wo

              • Think of it from another angle.
                The money incentive is good enough of a reason to start researching. It's a matter of choice. between companies A, B and C, where A definitely offers a reward, B "might" offer you something crappy and C gives you the finger or even worse, sues you, WHAT would you choose? It's equally moral to research for all the above companies, and equally moral to provide them the results; I agree with that. But then, once the moral equality exists, you look at other parts of the deal, and

                • Erm, bounties aren't a good reason to start security research. "Bounty hunting" is in a primitive form of compensation which is usually supplanted by more stable, reliable arrangements for all parties.

                  If you're good at that sort of thing, you get a perm job, being paid the money Yahoo would allocate to employees rather than PR exercises.

                  I mean I think Yahoo has been pointless since before the turn of the millennium, but that's another matter...

                  • Erm, bounties aren't a good reason to start security research

                    No, they're a good reason to pick which one to research, out of many options otherwise equal.
                    It's like this: I have a lawn mower, and in front of me there are three houses which need mowing. Should I pick the one where the owner gives me 10 bucks, the one where he gives me a "thanks" or the one where the guy chases me down the road with a shotgun, shooting salt pellets at my ass?

                    If you're good at that sort of thing, you get a perm job, being paid the money Yahoo would allocate to employees rather than PR exercises.

                    That's outside the scope of the conversation. Maybe you already have that job and are doing extra stuff for fun. Fun is in all cas

              • by Anonymous Coward

                Yahoo has ensured that the next time someone finds a vulnerability in their webpage, it will go up for sale only to criminal organizations. You can argue until you're blue in the face about what should be, but that doesn't have an impact on what is.

                • Just because you're a cunt, it doesn't mean everyone who finds a vulnerability is.

                  • by HiThere (15173)

                    No, as P.T.Barnum is supposed to have said "There's a sucker born every minute."

                    And it doesn't take "everyone who finds a vulnerability". It just takes one, as long as the others aren't motivated to report it "responsibly". (I wouldn't bother to report it if after the bother of dealing with lots of idiots and paperwork, the only reward was $13 off and advertisement for the company I was trying to help. And that's what they offered. I bet they still make a profit if the t-shirt is sold.)

              • by Sun (104778)

                There are more ways to pay for vulnerability data than just money.

                I was once the in-company contact point for those matters at Check Point. Check Point did not (I'm not sure whether they do today) offer bounties or any other monetary rewards. That was okay, because that was a well advertised policy.

                I tried to make really really sure that whenever a researcher reported a vulnerability, they would get the only payment I could give - credit. Once someone reported a buffer overrun, and agreed to hold off publis

            • by ToddInSF (765534)
              I'd like to see hackers go after Yahoo's CEO and board members. Embarass them all. Get them all fired.

              As a matter of fact, I'd like to see this done to many corporations. It's really the last avenue free people have in our new tech totalitarian corporatogovernment fascism.
          • Re:This is news? (Score:5, Insightful)

            by AmiMoJo (196126) * <mojo@world3AAA.net minus threevowels> on Tuesday October 01, 2013 @07:40AM (#45000795) Homepage

            I see it differently. In real life we pay for cops via taxes. Part of their job is to offer advice and even survey your home for ways that criminals might break in. It's part of the service.

            The internet doesn't have cops, but it does have criminals. Fortunately there are good guys who are willing to report flaws when they see them. Unfortunately many companies react to this helpful advice by threatening to sue or even trying to have the white hat arrested. Bug bounties make it clear that the company sees reporting as a valuable service and intends to act swiftly on reported problems.

            Bug bounties also encourage people to look for issues from the outside, which is apparently quite valuable since the people on the inside seem to miss them quite often.

            Companies should pay bug bounties when the issue is security, not as a kind of protection money but as a way of saying they take security seriously and wish to reward those who help them with it.

            • The internet doesn't have cops

              Erm, yes it does. Law enforcement are as aware of the Internet as anything else. Perhaps they misallocate resources, and perhaps that's what you need to concentrate on fixing.

              Unfortunately many companies react to this helpful advice by threatening to sue or even trying to have the white hat arrested.

              Anonymous reporting is easy. If you attach your name to a public report then you're really using the threat of crime for personal profit. Try not to think about it from the PoV of the ego of the hacker.

              Companies should pay bug bounties when the issue is security

              They're welcome to offer them, although it's really more a PR thing "We're already so secure that we only expect to pay out a small amo

              • The internet doesn't have cops

                Erm, yes it does. Law enforcement are as aware of the Internet as anything else. Perhaps they misallocate resources, and perhaps that's what you need to concentrate on fixing.

                Yes, to a degree, but no matter how well funded and technically capable law enforcement is, try going down to the local police station and get them to care that somebody set up a XSS attack on your web sight and the script in question seems to be located in eastern Europe, but you think the original attacker may be somewhere in south-east Asia and they've used some of your costumer accounts to send some spam email.

                Anonymous reporting is easy....

                Agreed, but I don't see why it should be a necessity. Though starting a bug report with "I am

            • Part of their job is to offer advice and even survey your home for ways that criminals might break in.

              No, sir. Their job is to collect evidence of a crime. Their job is not to protect and serve. Their job is to send the bad guys to jail
              • by HiThere (15173)

                Actually, their job is to protect the government. To do this they are allowed to enforce the laws, and several other things. This is basically PR and economics. (A safe environment is generally more profitable, which means it pays more taxes.) And if they observe a major crime (felony) they are supposed to try to arrest the perpetrator. Misdeameanors are optional. They can arrest, or warn, or even ignore.

                And I'm talking about honest cops. There are all to many who don't measure up to that. And the "

            • Re: (Score:3, Informative)

              by Lumpy (12016)

              "I see it differently. In real life we pay for cops via taxes. Part of their job is to offer advice and even survey your home for ways that criminals might break in. It's part of the service."

              What utopia is that that you live in? Because here in the USA they do not do this at all. The police advice to me is, "do not own a weapon, in the case of a home invasion hide under your bed and call the police. Do not fortify your doors and windows as that is a crime."

              Yes, Fortification of doors and windows in th

              • by AmiMoJo (196126) *

                That's why the US is a shitty hell hole where you have to own a gun just to live in some kind of relative safety where you are still far more likely to be murdered than anywhere in western Europe. Apparently it's a police state too.

            • by Wycliffe (116160)

              >
              > In real life we pay for cops via taxes. Part of their job is to offer advice and even survey your home for ways that criminals might break in. It's part of the service.
              >

              Where are you located? I've never heard of public cops giving home inspections. I've had ADT,etc... give advice (i.e. try to sell me stuff)
              and I've even had landscapers give advice (again, try to sell me on work), but I've never heard of public cops giving home audits.
              The only home audits I've heard of in the USA are energy au

          • I'm not sure what cognitive fault causes people to blame the victim, but it seems like a common thought process.

            It's a disturbingly common thought process that is most disturbingly used in sex-related instances, such as unplanned pregnancy and sexual assault.

            People don't want to accept that bad things can happen pretty randomly to good and well prepared people, so it's more comforting to assume the just world hypothesis. People get what they deserve, and as I'm a good person I'll surely be safer.

      • Oh, for fuck's sake, this argument is just awful. "Well, people SHOULD pay protection money, because otherwise anyone with enough strength might break their legs."

        You must be a philosopher, because your analysis, and the course of action that you derive from it, is only valid in a possible world that we don't live in. In the real world, society incurs expenses all the time to protect itself from malicious parties. Last time I bought a car, they were still putting locks on them. If you want to get worked up over this, you should start with the defense budget of the nation you live in.

      • We are talking about major company with lots of clients here. There shouldn't be big (or any at all) reward for finding holes in systems, owned by small companies with few clients. Analogically - there should be big rewards, if someone pointed out that e.g. bank has some physically weak spot underneath the building or some liquidity problems, that will definitely lead to bankruptcy. It is relevant how many people will be affected and how bad consequences will be.
    • http://news.yahoo.com/yahoo-ceo-ranked-2nd-companys-2012-pay-scale-001129756.html [yahoo.com]

      Regulatory documents filed Tuesday revealed that Mayer received a pay package valued at $36.6 million last year. Most of the compensation consisted of stock awards that Mayer got in July when she ended a 13-year stint as a top Google executive to become Yahoo's CEO.

      Most of the components of Mayer's pay had been previously disclosed.

      It wasn't previously known that Mayer ranked second on Yahoo Inc.'s pay scale last year.

      Henrique

  • by Anonymous Coward

    Don't you know that security vulnerabilities go into the NSA arsenal before they are fixed? Why do you still do "responsible disclosure"? Why do you work with the vendors at all? Security vulnerabilities are valuable, but you're propping up a corrupt system and get only peanuts in return, if anything. The NSA does not have moral hangups about their war on the internet. They use what you give them to undermine any and all security protocols. The only problem that companies like Yahoo have with cooperating is

    • And the solution is?
      No, really, aside words an speaches made as if you're wearing a V mask.
      • Re: (Score:1, Insightful)

        by Anonymous Coward

        Sell them.

        • by Anonymous Coward

          In which case the buyer might just be a straw man for the NSA.
          So your choice basically is: Tell the company and risk that the NSA gets it as well, or sell it and risk that only the NSA gets it. Now, which one is more responsible?

        • How does that fix the problem? That's what solution means.
    • Re: (Score:3, Informative)

      by Anonymous Coward

      Which part of "Forty-eight hours later, Yahoo had patched all of the vulnerabilities" did you miss?

      If you want to object here, then get that tinfoil hat straight and get some sharper Occam's razor.

      Seriously, if you think "bug reported to Yahoo -> NSA demands it from Yahoo -> NSA quickly uses it to hack Yahoo's accounts in 2 days -> Yahoo patches it" is realistic, then you should realize that "NSA demands access to Yahoo accounts -> NSA leisurely browses through all Yahoo accounts they want" woul

  • by viperidaenz (2515578) on Tuesday October 01, 2013 @04:07AM (#44999759)

    With the tshirt that says "I found a vulnerability and all I got was this lousy T-Shirt"

  • by cripkd (709136)
    You don't know what 12.5 is ?!?
    And you call yourselves geeks... Ahahahaha!
  • Why not half of what an exploit like that could cost on the black market, because that's how much it'll cost to even begin to look like anyone will pay attention to their 'bug bounty program'.
  • by Anonymous Coward on Tuesday October 01, 2013 @04:49AM (#44999949)

    When Microsoft lost their Hotmail domain name, some guy snatched it and kindly returned it to Microsoft because he thought it was the right thing to do, to protect Microsoft from their stupidity. Well, Microsoft sent him a personal thank you note and that was all. Yep, the guy could have legally resold the domain for like a billion dollars (wouldn't be the first time.. ahem, live.com) and gotten away with it. All he got was a lousy certificate of gratitude.

    • Re: (Score:3, Informative)

      by Anonymous Coward

      You mean this guy [doublewide.net] who got a cheque for $500 and a bunch of software for a problem that took him 2 minutes and $35 to address?

    • by sl4shd0rk (755837)

      All he got was a lousy certificate of gratitude.

      Maybe all the people using hotmail could pony-up $2.00 for the guy. After all, they are the ones who would really be affected should the domain be sold.

    • by antdude (79039)

      If he kept the domain, then MS would have sued him.

  • Not bad (Score:5, Funny)

    by Anonymous Coward on Tuesday October 01, 2013 @04:53AM (#44999973)

    C'mon. This is WAY better than the Standard Operation Practice: suing them into the ground.

    We're moving forward, it seems.

  • There was no expectation in the beginning except to get the problem solved, and that's what happened. Do you want them to hold the vulnerabilities for ransom or something? Maybe in the future some good samaritan will help you out with one of your problems too. Think of all the users you have helped out as well.
    • by mysidia (191772)

      There was no expectation in the beginning except to get the problem solved, and that's what happened. Do you want them to hold the vulnerabilities for ransom or something?

      Well... they didn't have to hold them for ransom; they could very well have taken the vulnerability to various dark spots on the internet and marketed it. I imagine, they could easily get a few hundred K selling a vulnerability like that on the open market.

      • You could make a lot of money auctioning information about all your neighbors and their valuables and schedules to local burglars too.
        • by Gibgezr (2025238)

          Could you point me towards more information on this? I like the sound of this "sell out my neighbours on ebay" plan. Not all my neighbours, mind you, just one in particular.

          • Could you point me towards more information on this? I like the sound of this "sell out my neighbours on ebay" plan. Not all my neighbours, mind you, just one in particular.

            Well, we like to be discrete so we do these exchanges in person, you see. So, I'll just need your address to get started. Oh, and I'm afraid I have terrible pet-dander allergies. Have you any bunnies, doggies, kitties, or other pets? The schedule's a bit busy this time of year (pre-Christmas rush), so what times are you available in the evenings for us to meet?

    • by Anonymous Coward

      Why do you think that if someone finds a vulnerability in Yahoo's stuff their efforts now belong to Yahoo? What if the person just doesn't want to give it to Yahoo? Do you think that their work should be taken from them summarily? Maybe in the future, only those willing and able to sell the vulnerability to scammers and criminals will be the ones looking because the others had to find some other work that pays bills.

  • by Anonymous Coward

    I think Yahoo acted correctly in this case. I think paying people to much for bugs will distort the security landscape. The reason is security is an issue about the common good. No vulnerability is good... even if it is in your competitors products. We should have a culture of assisting with security issues without expecting money for it.

    What will we have? People selling vulnerabilities to the highest bidder which is socially acceptable? Note that the word here is social, NOT commercial.

    Of course security

  • by istartedi (132515) on Tuesday October 01, 2013 @10:25AM (#45002403) Journal

    Wow. That's all kind of fail. It would be better for Yahoo to state as a matter of policy that they don't pay bounties. You might disagree with that; but at least you'd respect it. What they did instead is the equivalent of leaving a nickel tip at a restaurant. Giving nothing makes you look cheap, careless or unaware of tipping customs. Giving the nickel says, "yes, I know I should tip, here's what I think you're worth".

  • That's quite a blatant yet sneaky way to get these blokes' addresses and credit card infos -- tshirt+shipping is likely over $12.50. Know thine whitehat.
  • A T-shirt or something...
    Hey! It's better than getting sued!
    (As has happened before.)

C makes it easy for you to shoot yourself in the foot. C++ makes that harder, but when you do, it blows away your whole leg. -- Bjarne Stroustrup

Working...