"Pocket does not provide monetary compensation for any identified or possible vulnerability."
Cheapskates. This could have cost them money if somebody abusive had discovered it first. He deserves a monetary award.
[edit] Should we be concerned about the massive number of people listed on that page who have found security problems with Pocket? I counted 153 separate people...
This isn't some free service being run out of the goodness of somebodys heart. This is a company, that wants to make money. If a company has that many employees, they can afford a bug bounty program too.
1. What people are reading
2. What they will read
3. What they have read
4. What they are just bookmarking/RILing and not reading
5. Etc etc.
That's valuable data imho.
Maybe they're just being evil, you know, like Oracle.
You shouldn't do work based on "they haven't had a bug bounty before now but maybe they will make one just for me."
Heaven forbid, people submit security issues because they want to be helpful or care about the project.
Had I been OP I would have sold the exploits with no remorse, we don't need companies like that on the market, rewarding corporations for bad behaviour with free labour is fucked up on every level.
I'm pretty sure that in my country I can sell whatever software I want, as long as I brand it as 'automatic patch management testing' or something...
That word has lost all weight, right along with "terrorist".
It looks like their view of the activity isn't that it's fine to do, rather that they don't care that it's not fine. This implies that they know and accept that it's not fine.
Selling exploits to the black market does strike me as unethical, though.
If I gave them away and they get exploited is it unethical? If I gave them away publicly vs privately does it make a difference? If I responsibly reported to the manufacturer a month previously?
I guess intent matters, and I'm ok with that being the line. In the end though I feel the rewards for fast production far outweigh the consequences of security bugs. My firefox updated last night and added pocket and I was reminded that I couldn't even remove the useless bloody thing.
I'm not an expert on responsible disclosure, and I think reasonable people can disagree on the best course of action. I think selling exploits on the black market is always unethical.
> I couldn't even remove the useless bloody thing.
Right click, "Remove from toolbar".
This isn't doing work for free, this is a hobby. The time spent by this person was not requested by Pocket and they shouldn't be maligned just because they're not paying him.
Also, "sold the exploits with no remorse" really makes you sound like a troll. So I'm feeding.
If you want to get paid for your security work, you should convince someone to hire you, not work on spec for someone who did not hire you.