Would do right by the kid and would tremendous free publicity for the companies looking to supplant PayPal.

Say, you sell it to someone and to the best of your knowledge they want to claim the reward for themselves. To justify the increased price you received by selling it to a third party instead of submitting it for the bug reward you could say that the third party intends to claim the bug as his own work and the professional cred they'll receive justifies the increased price.

[1] http://www.techrepublic.com/blog/security/guess-whos-buying-...

"Hey, that building has a broken window."

IANAL.

Correct me if I'm wrong, but I don't believe that have to do... well, anything. They could shut down tomorrow and take all the money and it would be perfectly legal.

Section 6 of the PCI DSS deals with known vulnerabilities, I doubt they following it if that's true.

I am very confused by your statement.

There may be less protection than if they were banks, but it would hardly be legal. They might be able to steal the money and escape with them in a way a bank can't, but again, not legal.

I love it.

I have a few friends who work for PayPal support; apparently under 18 customers who put in a fake date of birth call all the time because they can't setup a bank account to receive their money (usually from minecraft server donations).

either way, paypal is indeed handling this in the worst way possible.

I'm agreeing with everyone else - the work done is not dependent on age, nor is the payment of the gratuity, so give him the dough he deserves and quit embarrassing yourself PayPal!

They will do anything they can to say the vulnerability is out of scope. Even some heinous vulnerabilities.

It's quite tragic paypal wants to discourage responsible disclosure when one incident will cost them their reputation.

(but good to see again)

Of course there might be legal reasons for excluding those below a certain age (though 18 seems high for this boundary) as they don't want their offer to be seen as employing minors.

For any company that offers bounties, my points are still relevant: not handing the out to a subset could encourage that subset to look for reward elsewhere, and the perception of labour use could be an important consideration.

Public relations has nothing to do with true facts, it has everything to do with how people interpret the details they see. If someone does mis-interpret and get on their high horse, others will join in without checking the facts themselves and it can be a nightmare trying to point out the truth of the matter over all that noise.

I think we need to start introducing limits on the height of horses :)

I had to stop using ebay because of problems with paypal. Tried solving it for a few months, but gave up.

Considering Google is retiring checkout, there are not many players out there.