I contacted BitTorrent and told them EXACTLY what I did , what information I had access to and what user/passes needed updating, including SSH keys and more. Whilst I gave a small generalization of what was at hand on the thread, there was a considerable amount of data available to me.

- MentaL (RZ Thread Starter).

Scenario 1: You find a boy who is lost and take him to the police station. The family gives you $500 in reward.

Scenario 2: You find twin boys who are lost and take them to the police station. The family gives you $500 in reward.

Would the fact that you get the same reward regardless of the number of people lead you to act differently in the future? So if next week you found lost twins again, would you let them stay lost or try to sell them on the black market because you know you'll only get $500 when you think it should be $1000?

Or is doing the right thing its own reward regardless of whatever amount you get in recognition for acting honorably?

Who wouldn't help a lost boy for free ?!

Many otherwise sweet young women (or men!) several of us probably went to school with, for a start. :|

Edit: Was trying to give some help to somebody puzzled about this, which is why I bring it up. Turns out that, if you're a lost young man, there's probably a point in your travels where you zigged instead of zagging and thus lost your way.

In the "lost child" scenario, it seems to me there's some ranking like:

1) helping out 'cause it's the right thing to do.

2) helping out with some hope there'll be a reward.

3) not helping out, 'cause there's probably nothing in it for you.

4) helping out with an expectation of a reward.

5) helping out with an expectation of reward then complaining publicly 'cause it's "not enough"

…

VERY_LARGE_INT) Abducting the child.

While there's a long way between 1-5 and the biottom of that list - there's no doubt in my mind that 1 & 2 speak significantly better of the "helper" than 3, 4, & 5. (and interestingly, there's no "outside" difference between 1 and 2 or 4, unless you choose to admit your mercenary inclinations to onlookers.)

Things are a bit murkier in the guy in the article's case, since "bug bounties" are known about and perhaps "expected", and I think Bit Torrent handled this badly, but further down the thread he admits "This was all 100% accidental, truth! At the end of the day If I wanted to 'hack' BitTorrent I wouldn't even know where to begin. I mean, there is no real skill or talent involved in what I did to find the information on BitTorrent." That makes it hard for me to feel sympathy for him failing to get a windfall "bug bounty".

Scenario 3: Same as scenario 1, but a month earlier a different person saw a "missing boy, reward" sign for the same child and searched them out. They received $30000 from the family.

Wouldn't you find that unfair?

Or was the post misleading and the other bounty was a different company, in which case I take it back.

Seriously? In this case it's more like there was a reward for their son, and this guy found their missing dog. Either way, you would complain about not getting a reward for finding a missing child? Full stop. Prior information doesn't matter, what was the alternative? If you had known there was no reward, would you have acted differently?

I would complain if a reward was offered and I didn't get one. I don't think that makes me a bad person. I'd save the child either way.

bringing up lost kids is misleading because people care about other people in a manner that they do not care about faceless companies.

They offered $500 as a nice and thankful gesture. If you wanted money, take it and don't cry about not getting more. You're not entitled to more money nor do you deserve more.

Now you just sound entitled AND righteously indignant...

You should have just released it all. j/k... not really.

If you were able to break into Valve because they failed to secure some login, and as a result got access to their Source Engine. Would $500 be enough to silence you?

Yes. Of course.

You would insist on more than $500? To stop you from hurting a company by releasing things you obtained unlawfully? Isn't that unethical? Illegal?

I would -- in fact I have! -- reported serious security vulnerabilities with no expectation of financial reward.

Worse than that, you have probably (as I have) reported plainly-obvious security vulnerabilities with at least a faint twitch of nervousness that the recipient is going to flip out and start suing or something. Worse than no expectation of reward from a utility point of view!

If you use someone's non-protected wifi for illegal activities, like downloading porn, then the owner of that "hotsport" is responsible at court. (At least in Germany afaik)

This is no different and I'm sure that you could win at court with a good lawyer

In the US when you provide wifi to people you are just as protected as your ISP. You might be in violation of your ToS but that's an unrelated issue.

What metric does Germany use to distinguish between 'ISP' and 'not ISP' when it comes to providing internet service?

The problem the previous poster was descrbibing wasn ot when you act as an ISP, but when someone manages to log into your wifi (either because it's unprotected or unintentionally vulnerable), and performs criminal activity. The US legal system has reliably shown itself willing to pursue the owner of an IP address, without going to the trouble of showing the owner was in fact the one using the IP for that purpose.

Someone using your wifi means you are Providing Internet Service to them. Is the problem that you're not incorporated? If it's based on IP allocation, what if your home connection has 8 IPs and you give one to each user?

If your WiFi get's hacked because it had too low security standards, like WEP, then you're still responsible for what's being done with your line. But you're irresponsible if you have taken care of security by following the router's wizard. There is no such case, that the manufacturer was blamed to offer too low security until now though (afaik).

How about a "job offer"?

http://www.eurogamer.net/articles/2011-02-21-the-boy-who-sto...

what ransom? he did not threaten them with anything; he's just annoyed now because he feels they didn't reward him sufficiently. not the same thing as trying to extort money out of them to reveal the vulnerability.

If I left my front door open one day, and you happened to find it, should I reward you for not stealing anything?

of course not. but i would not think it weird if you rewarded me for finding you and telling you your door was open.

more to the point, there is a social expectation that large companies will be grateful for vulnerability reports, and reward the reporter accordingly; the poster is well within his rights to be disappointed that they did not.

no, he didn't get anything, but promises!