Hacker News Reader

Comment by citricsquid | Hacker News Reader

Looks like he acquired login information, he didn't exploit some sort of major vulnerability that needed to be fixed which is generally what bug bounties seem to be for. He's insulted he didn't get paid for not being an asshole, what a strange world we live in. Facebook (or any other company) wouldn't pay out if one of their support staff accidentally made a random user an admin, why should this be any different.

View on HN

He didn't get credentials, they never secured their admin panels:

> A friend was looking for a hosting provider and wanted it all secure, I checked a network range and found the Jenkins panel of BitTorrent. This was all 100% accidental, truth! At the end of the day If I wanted to 'hack' BitTorrent I wouldn't even know where to begin. I mean, there is no real skill or talent involved in what I did to find the information on BitTorrent. They forgot to set a user/pass to the admin panel, that had access to github from a master account. Github accounts had user/passes that was linked to everything.

> No hacking, just random find. Mad huh?

Like he says on the forum thread, he did not acquire any login information. Just the opposite, in fact. They neglected to set a username/password to their admin panel. That's a gaping security hole if I've ever seen one.

He stumbled across a major vulnerability that needed to be fixed, not login credentials.

>He's insulted he didn't get paid for not being an asshole, what a strange world we live in.

That's how bug bounties work, yet people don't complain there.

Reply on news.ycombinator.com