Re:So I’m the guy who sent the t-shirt out as a thank you
by mikeash on Thursday October 03, 2013 @11:25AM
(#6489536)
I think you're absolutely right. There's nothing fundamentally wrong with giving a t-shirt, or even a gift card for a t-shirt, if it's properly communicated. But it has to explicitly be something like, "Thanks so much for this. I'm terribly sorry that we can't give you a proper reward, much though I'd like to. As a small token of my appreciation, I hope you'll accept a t-shirt as my way of saying thanks. Since I don't know your size, here's a gift card you can use to obtain whatever size and style you prefer." If it had been done like this, I think it would have gone over fine. There might be some grumbling about how a large company "should" have a bug bounty program, but not the sort of attitude we've seen.
As best I can tell, the gift card was offered without comment. And while the intentions were good, the lack of such a message meant that it was taken badly.
I guess the lesson is, if you're offering only a token of appreciation, make sure the recipient knows you know it's only a token.
I think the problem mostly lies in conflating "token of gratitude" with "gratitude". The token is a cheap thing, and has some small monetary value. The gratitude itself is a much more valuable thing, for both the giver and the receiver. Reporters are motivated by doing the right thing, and perhaps getting some recognition for their contribution. The recognition has two parts: recognizing cleverness (you caught something others missed), and recognizing honor (doing the "right thing", reporting it to the affected party rather than exploiting it yourself).
You can't put a price on cleverness and honor. And if you try to, and you come up with $12.50, then you're an idiot. The only thing you can do is recognize it, and show gratitude for the help.
What the OP tried to do was show gratitude and recognition with a token, and some recipients confused the token for the gratitude. It doesn't sound to me like the giver was confused! E.g. he wasn't saying "Here, let me pay you for your time, eliminating the need for us to recognize your cleverness and honor for the cost of a T-shirt." Now you might say that the token was poorly chosen: there is a reason people invented trophies, items that are totally worthless other than as tokens of accomplishment. It's because the recipient will NEVER confuse a trophy for the price of the accomplishment behind it.
Personally, I think a cool little useless trophy would have worked better, and certainly no gift certificates! Being named and honored somewhere on the Yahoo website would be great. Giving a small cash prize, like $1000, would be a classy move.
The bottom-line remains: there was nothing fundamentally wrong with the T-shirt-as-trophy, apart from the (apparent) risk of recipients confusing it for T-shirt-as-payment.