Re:Yahoo, please start with a Vulnerability Reward Program
by ISL on Sunday May 19, 2013 @12:07PM
(#5733251)
Well, it sounds like the author feels entitled to a 'thank you'.
Trouble is, it's not necessarily in the company's interest to acknowledge a past vulnerability in writing. Security team could've called him though; no paper trail, and it would've felt very authentic and personal.
Re:Yahoo, please start with a Vulnerability Reward Program
by quackerhacker on Sunday May 19, 2013 @05:24PM
(#5734446)
Acknowledgement, I agree, is required at least. The OP got that from a bot. Monetary is always nice, but reputation...or just an ACTUAL person on the dev team saying "thank you for your help," is better than NOTHING as assumed in this article.
Re:Yahoo, please start with a Vulnerability Reward Program
by bluesmoon on Monday May 20, 2013 @06:13PM
(#5740459)
actually that wasn't a bot. the volume of security reports is too low to require an automated task. that mail was probably sent out by someone from the security team. It is a form letter, but that's for consistency across responses.
Re:Yahoo, please start with a Vulnerability Reward Program
by btipling on Sunday May 19, 2013 @12:03PM
(#5733237)
It's not self-entitlement, the OP is not obligated to help Yahoo! and simply states that there will be no more work for free.
It's in Yahoo!'s incentive to provide whitehats incentive, because people with malicious intent already have incentive and Yahoo! should want legitimate security research types to find vulnerabilities before attackers do.
Now a lot of the major players have policies promising no legal action for responsible disclosure, some even have rewards (whether monetary or acknowledgement) for the hackers.
In this case, a response was given, no legal action was threatened, and the bug was quickly fixed. Isn't this the goal? Looks like Yahoo is doing their job here.