You are right there are two views, but they are reconcilable.

I think the problem mostly lies in conflating "token of gratitude" with "gratitude". The token is a cheap thing, and has some small monetary value. The gratitude itself is a much more valuable thing, for both the giver and the receiver. Reporters are motivated by doing the right thing, and perhaps getting some recognition for their contribution. The recognition has two parts: recognizing cleverness (you caught something others missed), and recognizing honor (doing the "right thing", reporting it to the affected party rather than exploiting it yourself).

You can't put a price on cleverness and honor. And if you try to, and you come up with $12.50, then you're an idiot. The only thing you can do is recognize it, and show gratitude for the help.

What the OP tried to do was show gratitude and recognition with a token, and some recipients confused the token for the gratitude. It doesn't sound to me like the giver was confused! E.g. he wasn't saying "Here, let me pay you for your time, eliminating the need for us to recognize your cleverness and honor for the cost of a T-shirt." Now you might say that the token was poorly chosen: there is a reason people invented trophies, items that are totally worthless other than as tokens of accomplishment. It's because the recipient will NEVER confuse a trophy for the price of the accomplishment behind it.

Personally, I think a cool little useless trophy would have worked better, and certainly no gift certificates! Being named and honored somewhere on the Yahoo website would be great. Giving a small cash prize, like $1000, would be a classy move.

The bottom-line remains: there was nothing fundamentally wrong with the T-shirt-as-trophy, apart from the (apparent) risk of recipients confusing it for T-shirt-as-payment.

I think you're absolutely right. There's nothing fundamentally wrong with giving a t-shirt, or even a gift card for a t-shirt, if it's properly communicated. But it has to explicitly be something like, "Thanks so much for this. I'm terribly sorry that we can't give you a proper reward, much though I'd like to. As a small token of my appreciation, I hope you'll accept a t-shirt as my way of saying thanks. Since I don't know your size, here's a gift card you can use to obtain whatever size and style you prefer." If it had been done like this, I think it would have gone over fine. There might be some grumbling about how a large company "should" have a bug bounty program, but not the sort of attitude we've seen.

As best I can tell, the gift card was offered without comment. And while the intentions were good, the lack of such a message meant that it was taken badly.

I guess the lesson is, if you're offering only a token of appreciation, make sure the recipient knows you know it's only a token.

I wish a sociologist or anthropologist would comment and explain formally what this is but I'm thinking it is something along the lines of a thank you or appreciation not being quantifiable. Where as putting money (or something quantifiable) on the table communicates some sort of value.

I'm not a sociologist, but I've had a longstanding interest in the origin of manners, so I've read a bit on this. The problem here is that putting a number on something invites comparisons. We almost can't help comparing numbers. If my friend gets a number and I get a "You are awesome! Thank you so much!" I can't easily compare those because they are unlike each other. But when my friend gets a 500 and I get a 12.5, it is obvious to everyone that the number I got is so much lower, it's embarrassing. That guy's number is way bigger than mine.

Basically, no monetary reward is necessarily expected here. But once you give one, it is a faux pas to give one that looks small in comparison to what is considered the "norm." We even have common insults reflecting this fact, where bragging about something I impressive will invite comments like, "Wow, here is a shiny nickel." The impromptu offer of a clearly paltry reward is understood as a slight.

Yahoo "owed him one" when he reported the vulerabilty.

When they traded a shirt for the report Yahoo was implying that they no longer owed him anything, it was a fair barter

Yeah, I'd like a better explanation myself. I feel it, but I can't really explain why.

It seems like there are just two distinct modes. When you do something for free, you're basically doing a favor, and you get pleasure from being altruistic. Once you get paid, it's now an exchange of value, not altruism, so you only get pleasure from being paid. If the pay is small, you'll feel upset because your end of the bargain is based entirely on that, while if you're doing it for free, you switch over.

I could be full of it....

If nothing is given, you assume the first party is indicating that their thanks/recognition is enough.

If something is given, then they are acknowledging that their thanks/recognition is not enough, but that $x monetary value makes up the difference.

Some people take it as an insult that if thanks isn't enough, they can be 'bought' for $x, where $x is $12.50, or whatever. The reasoning is basically that if you are saying the time taken to reproduce and report the issue is important enough to compensate, you should probably compensate commensurate with what they would expect to make for their time/expertise.

I think most people who report these things do so because they want to improve things, not for the money, so most probably fall into the first camp, but I can understand where the second camp is coming from.

No, I get what you're saying. But they originally DID do this task for free. The work they did was already done regardless of what Yahoo did with their report next. If they were expecting or counting on a charity gift from Yahoo, that seems like a mistake.

> separate tasks done for free for fun or just to be nice, from tasks done for money

Sure. But given the lack of a formal bounty program at Yahoo!, it was a poor choice to pick them as a place for "tasks done for money"

They didn't necessarily pick that, though. When you submit a vulnerability to a company that doesn't have such a program in place, it is their choice as to whether that falls into the "free" or "paid" category.

Yahoo's reaction put it into the "paid" category, and then paid an insultingly low amount. That was their error. A different reaction, even just different wording when sending the gift card, could have put it into the "free" category.

You can see it as an insultingly low payment or as a bigger than usual thank you. If you expected nothing, the shirt is a pretty decent thank you. If you expected to be paid, the shirt is an insult. Clearly the people who bitched about the shirt expected to get paid. So they had already put their work in the "paid" category and then complained when the pay was low. It sounds like a lot of other people didn't expect anything and put their work in the "free" category and were (at least a little) pleased to get an unexpected thank you.

You are misunderstanding things. A dollar amount automatically puts it into the paid category, because it is comparable.

You are misunderstanding things. It used to just be an actual t-shirt. But people who already had a t-shirt said they didn't need another one. So an equivalent amount of store credit was given to get something other than a t-shirt. I guess he could have just offered for them to pick from a few different schwag items. Any physical item as a thank you is going to have some sort of dollar value... but I still don't think that automatically puts it into the paid category.