Hacking Imgur for Fun and Profit
medium.com
medium.com
However, and I know this is not a popular opinion and that most people argue they do it "just for fun". But in my mind the "just for fun" argument is nothing more than an excuse for letting large corporations* use you. Seriously, swag? Your hourly salary is minimal wage. What about all the time you spend studying? You should get payed like everyone else. Even if you really think it is that much fun, why wouldn't you want to be able to make a living out of it? Your knowledge should be (and are!) valuable.
I don't really have a solution. Maybe time is the answer. Globalization does not make it easier as the bounties are quite large from the perspective of some countries.
What do you guys think? I think it is time we start valuing our knowledge. No one will do it for us.
* If it is a start-up, non-profit, or a corporation you believe makes the world a better place the situation is different, obviously. Nothing wrong with volunteering your knowledge.
Fin Tech companies, for instance, have regulations that require a professional audit every year. We recently paid out over $25k for one of them (and it was worth it, their guys found some extremely subtle vulnerabilities).
Also hacking on sites for fun and profit is fun and something some people like to do in their spare time. So some people are gonna do it no matter what.
When I read about this stuff, it seems like half of the articles end with some company either patching or not patching their security holes with some tester maybe making some money and the other half end with someone being charged for accessing public-facing data that wasn't meant to be accessed.
1. Does pursuing the vulnerability further benefit the research? 2. Would it cause any damage?
If the answers are yes and no, I'll happily see where it takes me and re-evaluate as I go on. With bug bounty programs it's generally expected that researchers are going to poke and prod at things which they otherwise shouldn't, although some programs do specifically state their objections to pursuing issues further. Facebook, for example, would rather you find an issue and report it straight away while others might admire your creativity to show exactly what an attacker could do.
The alternatives are to be a criminal or let tens if not hundreds of thousands of users risk being compromised. I rather dislike Imgur - but if I discovered a vulnerability I would still report it to them.