News for hackers. Stuff that matters.

A comment on How I could have hacked any Facebook account. Parent comment

Re:How I could have hacked any Facebook account by arcticfox on Tuesday March 08, 2016 @09:49PM (#11250541)
The bizarre part here is that Facebook is competing against a market that the security researcher is not allowed to participate in by law.

Facebook sets the price, not the market. That's why the speculative value of a bug should be relevant, not the practical value. If this guy were allowed to openly market his bug to all parties, it would be guaranteed to be worth much more than $15k.

The price to Facebook is totally arbitrary. They could pay this guy $10 and it would still be fair under your position, because it's better than the alternative of committing a felony by finding someone to outbid Facebook.

[ Parent | on HN ]
Re:How I could have hacked any Facebook account by tptacek on Wednesday March 09, 2016 @11:53AM (#11254023)
That's almost true. If Fb bid only $10, you could see bidding simply for the right to (a) announce the bug or (b) post a hash and lord it over Fb. There's a vanity value for some of these bugs that probably goes into the hundreds of dollars.

But the rest of your point? Yep. Sounds about right. Though I don't think it's quite fair to say that "Fb sets the price, not the market", since Fb is the market for these bugs.

[ Parent | on HN ]