Re:Slack account takeovers using HTTP Request Smuggling
by totony on Friday March 13, 2020 @09:52PM
(#22572512)
The difference I think most people are missing is that Hackerone will not pay you if you don't find a bug. So they do not value your time, they value the results.
Leads to the conclusion that they should pay for the results and not for the time it took to find it. Also, there might have been weeks of failed attempts before finding this.
Re:Slack account takeovers using HTTP Request Smuggling
by londons_explore on Friday March 13, 2020 @05:11PM
(#22570919)
And then there are the people who want to be paid whichever is the higher of the two approaches.
This is reasonable if you look at it as "just another job" -- you're being paid to build Good Software, so just another day at work. Or you're doing a Good Thing by helping a lot of people not get pwned.
This is unreasonable if you look at is as value-creation: "how much is this worth on the black market" or "what is this worth to Slack as a company".
Other people can get into the socioeconomic or means-of-production or entrepreneuring implications of all this, but I just think whether you downvoted or upvoted this provides a useful mirror into how one values one's own professional work.