Slashdot Mirror

← Back to Stories (view on slashdot.org)

Yahoo To Offer Bug Bounty Rewards Up To $15,000

Posted by samzenpus on from the pay-me dept.

aesoteric writes "Yahoo is set to launch its first formal bug bounty system after Swiss pen testers complained about the $12.50 vouchers offered for locating XSS vulnerabilities. The web giant also said the voucher rewards were informal and actually funded out of the pockets of the company's own IT security staff."

29 of 65 comments (clear)

  1. In other news... by Frosty+Piss · · Score: 5, Insightful

    ...The once powerful Yahoo grasps at straws to attract developers back after fucking them over for a few years...

    --
    If you want news from today, you have to come back tomorrow.
    1. Re:In other news... by msauve · · Score: 1

      Well, they do have the name right - they're all yahoos. Seriously, is there anything Yahoo! does, which someone else doesn't do much better?

      --
      "National Security is the chief cause of national insecurity." - Celine's First Law
    2. Re:In other news... by hutsell · · Score: 1

      ...The once powerful Yahoo grasps at straws to attract developers back after fucking them over for a few years...

      Perhaps even the non-developers — the Yahoo! Yodeler, Wylie Gustafson is one that comes to mind from over a decade ago.

      --
      Yesterday's Weirdness is Tomorrow's Reason Why
    3. Re:In other news... by mechtech256 · · Score: 1

      Yahoo Finance is very good.

    4. Re:In other news... by GumphMaster · · Score: 1

      Nope, didgeridoo players and even Kenny G beat them hands down on this: Circular breathing

      --
      Patent litigation: A doctrine of Mutually Assured Destruction... in which everyone seems willing to push the button
    5. Re: In other news... by Anonymous Coward · · Score: 1

      Go home Ballmer. You are drunk. And fired.

    6. Re:In other news... by tripleevenfall · · Score: 1

      Well, actually from 1787 they were 3/5ths of a human.

      I don't think the word has any place in polite usage, but the is the internet.

  2. But... by Freshly+Exhumed · · Score: 1

    Do you still get the T-shirt?

    --
    I deny that I have not avoided attaining the opposite of that which I do not want.
  3. Re:Bugs? by Anonymous Coward · · Score: 1

    You still use both IE and Yahoo? How quaint...

  4. Definition of Scrooge by snero3 · · Score: 2

    the web giant also said the voucher rewards were informal and actually funded out of the pockets of the company's own IT security staff

    I don't know how many tshirts they gave out, but I am lead to believe it wasn't many. If someone freely out of their own good will helps you out, at your job! and you can only manage pony up $12.50 that is just an insult, I personally would prefer just a email of thanks than that!! Hell a case of beer maybe!!

    I beat these guys aren't first in line to order a round on Friday night

    --
    It said "windows 98 or better" so I installed Linux
    1. Re:Definition of Scrooge by Lunix+Nutcase · · Score: 1

      The Yahoo store sells six packs of beer?

    2. Re:Definition of Scrooge by jiriw · · Score: 2

      I don't know...

      Yes, someone did notify you of something you probably didn't realise yet. And it might have become a problem for the company later on... if the wrong people found out just that. That person did it freely and out of his/her own good but it doesn't necessarily makes your job easier (maybe even harder because now you have to solve this while there are already enough other problems on your plate). It won't reduce your workload... your employer has enough other things for you to do... it won't get you to that pub a minute earlier than your employer allows you to leave for the weekend (and that might be even later now). You won't tell that to the person who made that bug report 'tough. You're glad there are people actively want to involve themselves in the security of the product you're proud to work on even 'though they do it without prospect of financial gain.
      As a small thank you, you send the person a gift certificate paid from your own money, effectively saying 'Here is an hour of my time in wage. Please spend it on something you like to' (give or take... My reference is my current hourly wage, after taxes, as an IT professional, which is a little more, but not much).

      Of course there is nothing wrong with a proper reward program, financed by the actual company. If these bugs take at least some skills and resources to track, and are that valuable it would be rather cheap for a company not to have one. That having said, a pay check for services rendered from a company is totally different from an employee paying you a small token out of his/her own pocket while the direct value for that employee is, at least, questionable.

    3. Re:Definition of Scrooge by pla · · Score: 1

      Psychologically it's a different thing. Giving someone a small sum of raw cash instead of a gift worth about the same is generally considered crass.

      Only because we expect the humans giving us gifts to know us well enough to make it a bit more personal. In contrast, I want Yahoo to know as little about me as possible. They can send me $12.50 in BTC to an anonymous address, for all I care about how they reward people.

      Uncle Tony writing a $12.50 check: Crass. Yahoo writing a $12.50 check: Insultingly cheap, but otherwise okay.

  5. Undestroy by XB-70 · · Score: 2

    The Undestroy button is not working. The fix is to re-establish the chat rooms, clear the clutter from Yahoo! Messenger, make mail actually function at a reasonable speed and eliminate the mindless Hollywood crap from the main page. I'd like my $$$ now, please.

    --
    *** Don't be dull.***
  6. Re:Good luck getting paid by muphin · · Score: 3, Interesting

    that's counter productive, hiring a full time developer to scour the site for bugs would costs hundreds of thousands, and here we have people with the skill after a small amount. Also if the people doing the pen-testing get fucked over they just release the exploit and move onto a site that appreciates their time

    --
    It's not a typo if you understood the meaning!
  7. Talk about your risk by djupedal · · Score: 1

    Not taking anything that comes out of an IT staffer's pocket, thanks just the same.

  8. A modest bug bounty proposal by TheloniousToady · · Score: 2

    I've had a couple of friends whose Yahoo email contacts, including me, got sent spams which were crafted to appear as though the spam was from the friend. The spams contained links presumed to be armed and dangerous. I wonder if Yahoo has a bug bounty for that one? Heck, I'd chip in ten bucks myself if somebody would fix that.

  9. Found one by PPH · · Score: 1

    Its big, about the diameter of a silver dollar. Six legs, shiny black body, big pincers and semi transparent wings. Its sitting on cowboyneal's head.

    --
    Have gnu, will travel.
  10. What about labor laws? by Joe_Dragon · · Score: 1

    Some one may just say they did work and did not get paid and there is a full list of other stuff to come out let's say some works there and tells a friend about bugs they know about so that friend can get paid to tell them about it? OR even that is the way to get past the PHB.

  11. Damage Control by SeaFox · · Score: 2

    Yahoo is set to launch its first formal bug bounty system after Swiss pen testers complained about the $12.50 vouchers offered for locating XSS vulnerabilities

    In other words, Yahoo realized since word got around how lame their rewards were for reporting security vulnerabilities people were more likely to start looking to see how much more they could get selling them to the bad guys instead.

  12. C'mon Now... by flyneye · · Score: 1

    Hey, $15,000 will keep you in t-shirts and coffee mugs for life!

    --
    *Repent!Quit Your Job!Slack Off!The World Ends Tomorrow and You May Die!
  13. "Up to" - marketing magic by wonkey_monkey · · Score: 1

    I don't know what everyone's complaining about. $12.50 comes under "Up To $15,000," and I'll give up to $1,000,000 to anyone can prove me wrong!

    --
    systemd is Roko's Basilisk.
    1. Re:"Up to" - marketing magic by La+Gris · · Score: 1

      There is no wrong in your statement about $12.50 comes under "Up To $15,000,";
      So there is no circunstance where you would give me up to $1,000,000 in correllation to proving you wrong on the above.
      This is where I could prove you wrong.
      But giving me up to $1.000.000 for proving you wrong would prove you right.

      Finally, the only possible income of all this. is:
      - You have to give me more than $1.000.000 for, proving you are wrong on advertising a reward to an impossible circunstance.
      - And the reward has to be more than your "up-to" to save your wrongness or it would cancel itself.

      --
      Léa Gris
  14. Commend the Out of Pocket Expense by Kookus · · Score: 1

    That also just lowers the credibility of Yahoo. They have to have their own employees pay for things in order to operate... Sounds like a startup.

  15. So we can expect... by pla · · Score: 1

    So if Yahoo's recent history means anything, we can expect that the first bug bounty will pay 2 million dollars, which Marissa will claim for finding a font the wrong color, then she will immediately order the program ended for nebulous "abuses"?

    Of course, that would still sound better than giving out an insulting coupon for company swag. ;)

  16. Re:Bugs? by Lunix+Nutcase · · Score: 1

    What about the comet cursors?

  17. All I got... by bil_hendrix · · Score: 1

    What's on the t-shirt? Suggestion: "I submitted a bug report to Yahoo and all I got was this lousy t-shirt"

  18. This is actually worse. by intermodal · · Score: 1

    Before, it was Yahoo being cheap. Now it's Yahoo also screwing their own staff.

    --
    In SOVIET RUSSIA... erm...NSA AMERICA, the Internet logs onto YOU!
  19. I swear I thought I saw... by unitron · · Score: 1

    ..."Yahoo To Offer Bugs Bunny Rewards Up To $15,000"

    Darn floaters.

    --

    I see even classic Slashdot is now pretty much unusable on dial up anymore.