Hacker News Reader

I wonder if anyone has "cobra effect"ed the bug bounty world yet.. whereby they leave vulnerabilities in their code in order to obtain a bug bounty.

View on HN

Obligatory Dilbert

https://dilbert.com/strip/1995-11-13

From 23 years ago!

How did you find such a specific reference lol

Someone showed me this strip ~10 years ago when the place I was working briefly instituted a similarly counterproductive incentive policy. I just Googled "Dilbert code me a minivan"

I have never once heard of a bug bounty being paid to a former employee let alone to the same person who wrote the code. It strikes me as something that is likely to do damage to ones reputation far out of proportion the few thousands of dollars one might hope to gain.

I received a bug bounty from Mozilla after leaving, in a browser component I previously worked on. I didn't write the vulnerable code though.

On the other hand, Google refused to pay me a bug bounty for a bug I found in the same component, in part because I used to work on it when I was at Mozilla, even though I didn't write the vulnerable code.

Reply on news.ycombinator.com