It's a freemium service that doesn't depend on ad revenue. Maybe they're not made of money as Facebook and Google are and that's the reason for not compensating.

Here's a picture of their current team: https://getpocket.com/jobs - Here's a list of 7 other positions they're currently hiring for - https://boards.greenhouse.io/pocket

This isn't some free service being run out of the goodness of somebodys heart. This is a company, that wants to make money. If a company has that many employees, they can afford a bug bounty program too.

Not to forget the data they are getting:

1. What people are reading

2. What they will read

3. What they have read

4. What they are just bookmarking/RILing and not reading

5. Etc etc.

That's valuable data imho.

> they can afford a bug bounty program too

Maybe they're just being evil, you know, like Oracle.

I didn't say it was being run out of the goodness of someone's heart. That's why they need money, to pay the bills. Having infrastructure to deal with that many users on a popular service doesn't come cheap.

Uh, they've raised $14.5 million[0] and have over 17 million users. This isn't a side project. Not by a long shot.

[0] https://www.crunchbase.com/organization/pocket

So what? Do you think that money's not going into paying their bills?

I disagree. Mozilla signs a very rich contract with search engines like Google and Yahoo. They have more money than they know what to do with.

They aren't part of Mozilla.

Don't be so naive. Do you think you can just walk up to Mozilla and tell them: "Sup guys, just bundle this crap into your browser. Please."?

Mozilla claims that they don't get money for the integration, and I don't see a good reason why I shouldn't believe them. Pocket very likely doesn't have that much money lying around, compared to Mozillas budget.

That's makes it worse. Mozilla integrating Pocket into Firefox for free.

Really? Does it? "Mozilla bundles crapware for financial gain" vs "Mozilla bundling add-on it believes will benefit users".

its sounds a lot more like the situation was "Pocket was friends with some guys at mozilla, and they made up a bunch of bullshit about how it was a benefit to users to push their buddies project"

where did you get that impression?

"Mozilla bundles crapware for financial gain" v. "Mozilla bundles crapware without any financial incentive" is a more accurate comparison, and highlights that something is indeed wonky over in Mozillaland.

Pocket + Firefox is a pretty stanky integration. Very unpleasant to have it bundled in.

Maybe it's time for a standard bookmarking service API? It'd be nice to just be able to plug whatever service I want (if any) into any browser.

Greedy is better than stupid.

Yes, but Pocket is integrated with Firefox. Pocket and the Mozilla Foundation formed a partnership that almost certainly includes some sort of compensation or resources in exchange for Pocket's service.

Actually no, it appears that Mozilla is not getting any money from Pocket but rather chose Pocket themselves. https://www.reddit.com/r/firefox/comments/38aorv/psa_mozilla...

That's even weirder.

I think that number being high, if anything, demonstrates that they don't currently need to provide monetary compensation.

When you perform unsolicited work, you shouldn't expect to get paid for it.

Yes. Notice the corollary: if they had a bug bounty, we wouldn't be learning about this today, because someone who wants to make money probably would have already found them.

You shouldn't do work based on "they haven't had a bug bounty before now but maybe they will make one just for me."

Exploits in a proprietary cloud service like this are harser to sell, at least se acquisition programs are expressly uninterested in them. I wonder what effect that has on bug bounties

Apple, the world's most valuable company, doesn't have a bug bounty program either.

They also don't really seem to put much effort into releasing bugfixes in a timely manner. For a month and a half, you could reboot any iPhone in the world remotely via text message.

In some strange way that (non ironically) sounds like a feature.

>He deserves a monetary award.

Heaven forbid, people submit security issues because they want to be helpful or care about the project.

Heaven forbid we ask of a corporation that they compensate us for a job they should have done and preventing huge losses and a PR nightmare.

Had I been OP I would have sold the exploits with no remorse, we don't need companies like that on the market, rewarding corporations for bad behaviour with free labour is fucked up on every level.

Maybe they should have a bounty program, but they don't, and they made that clear. They didn't ask anyone to perform "free labor," and I don't think they have any obligation to pay for labor they didn't ask to be performed. I don't see anything unethical in their behavior. Your beef seems more to be with the researcher who decided to perform free labor for this company.

Selling exploits to the black market does strike me as unethical, though.

The black market does not want serverside Pocket vulnerabilities. These bugs only have value to Pocket.

>Selling exploits to the black market does strike me as unethical, though.

If I gave them away and they get exploited is it unethical? If I gave them away publicly vs privately does it make a difference? If I responsibly reported to the manufacturer a month previously?

I guess intent matters, and I'm ok with that being the line. In the end though I feel the rewards for fast production far outweigh the consequences of security bugs. My firefox updated last night and added pocket and I was reminded that I couldn't even remove the useless bloody thing.

> If I responsibly reported to the manufacturer a month previously?

I'm not an expert on responsible disclosure, and I think reasonable people can disagree on the best course of action. I think selling exploits on the black market is always unethical.

> I couldn't even remove the useless bloody thing.

Right click, "Remove from toolbar".

I'm a photographer and freelance software developer, I know all about not doing work for free and what that does to our industries.

This isn't doing work for free, this is a hobby. The time spent by this person was not requested by Pocket and they shouldn't be maligned just because they're not paying him.

Also, "sold the exploits with no remorse" really makes you sound like a troll. So I'm feeding.

If you're that worried about compensation, the correct answer is to determine up front whether there's a bounty program, and if not, move on. Not to do work you had every reason to believe would not be compensated, then complain when it isn't compensated.

You can ask them for a bounty program in the future, but you don't really have a right to get upset when they don't honor a bounty that was never promised. It's like demanding a reward for returning a dropped wallet.

So can I correct the grammar on your website and then send you an invoice?

If you want to get paid for your security work, you should convince someone to hire you, not work on spec for someone who did not hire you.

You would have committed a felony?

Seriously? In America today, just releasing balloons into the air is a felony: http://www.cbsnews.com/news/anthony-brasfield-fla-man-charge...

That word has lost all weight, right along with "terrorist".

Okay, so forget the word felony. "You would have aided/abetted a malicious criminal and profited monetarily by doing so?" My point is that selling an exploit doesn't become morally okay just because the company doesn't offer a bounty.

Except that morality is highly subjective and some people would be completely fine commiting a criminal activity just for the hell of it.

You say it's subjective and then the reason you give is that some people would, knowing that it's criminal, still commit a crime.

It looks like their view of the activity isn't that it's fine to do, rather that they don't care that it's not fine. This implies that they know and accept that it's not fine.

I don't know what to say after reading this. Did the act come into force after BP spill?

Depending on where OP lives, that might not have been a felony.

I'm pretty sure that in my country I can sell whatever software I want, as long as I brand it as 'automatic patch management testing' or something...

was going to ask about the bounty and then saw this. bummer.