Facebook rewarded a 10-year-old for finding Instagram security flaw

Re:Facebook rewarded a 10-year-old for finding Instagram sec... by charlesdm on Tuesday May 03, 2016 @05:25PM (#11624362)

He's 10. Who is he going to sell this to? $10,000 is probably a gigantic amount of money to him.

[ Parent | on HN ]

Re:Facebook rewarded a 10-year-old for finding Instagram sec... by wnevets on Tuesday May 03, 2016 @05:33PM (#11624410)

its a lot money to most people.

[ Parent | on HN ]

Re:Facebook rewarded a 10-year-old for finding Instagram sec... by charlesdm on Tuesday May 03, 2016 @06:19PM (#11624706)

Of course, but it might be worth $100-200k if sold to a third party.

Edit: looks like I was wrong!

[ Parent | on HN ]

Re:Facebook rewarded a 10-year-old for finding Instagram sec... by tptacek on Tuesday May 03, 2016 @06:20PM (#11624715)

No, it would be worth much less than $10,000 to anyone else.

There is a specific kind of bug that is worth 6 figures on the black market: clientside remote code execution. Somehow, HN has gotten the impression that the going rate for the hardest bugs in the world to reliably weaponize is actually the going rate for all bugs everywhere.

[ Parent | on HN ]

Re:Facebook rewarded a 10-year-old for finding Instagram sec... by mwcampbell on Tuesday May 03, 2016 @08:26PM (#11625321)

So you're saying client-side remote code execution bugs are the hardest to reliably weaponize? Do I understand correctly? I figured those bugs would be the easiest to weaponize.

[ Parent | on HN ]

Re:Facebook rewarded a 10-year-old for finding Instagram sec... by tptacek on Tuesday May 03, 2016 @09:09PM (#11625482)

We mean different things, and it's me being imprecise. Substitute "generate" for "weaponize".

[ Parent | on HN ]