Hacker News Reader

I'm like 99% sure they intentionally left a few 'low-risk' vulnerabilities which they knew people would uncover (and be rewarded for) to entice the big boys of security probing to roll up their sleeves and get to work looking for the really big ones.

In the long run, they're paying a reasonable amount of money for an army of security consultants to give the service a once-over. Smart!

View on HN

Is it so implausible that they accidentally left a few low-risk bugs in such a rushed project? It would be pretty damn impressive if all those low-risk bugs were actually intentional.

Why would you intentionally leave in potential vulnerabilities, if you hypothetically have the option to release bug free code and boast about it.

You never have the option of releasing bug-free code. So if they released code with bugs, called it bug-free, and boasted about it, someone would come along, prove them wrong, and embarrass them.

They wouldn't boast about it directly, simply having a bug bounty where no bugs were found/reported would do the boasting for them.

The publicity wouldn't be as effective. However, I can't see them doing this.

Reply on news.ycombinator.com