I don't understand what Yahoo did wrong. They didn't have to pay a cent but they did. I understand that it is nominal, but it is better than nothing. I guess just not in the case where the press can get a hold of it.
Yahoo gave them $25 in store credit at Yahoo.
I'd rather have gotten a nice letter, because that kind of "compensation" is as much trying to attract business to Yahoo products as it is trying to reward me.
In all likelihood, they'd have earned at least 10 times as much spending the same number of hours at Burger King, and probably over 100 times as much selling the flaws.
Grossly underpaying is much more insulting, because it says directly what they value your work at, than not paying, which may simply be a policy of not handing out rewards for that kind of behavior.
My point is Yahoo's message to the people would have been taken better as /just/ a letter, than a letter and a far undervalued "reward".
The funds are considerably more impersonal than simply giving a gift and demonstrate in a concrete way the low value it was given by Yahoo - not even worth a personal email to ask about tshirt size/style.
No, it's really not. Which is why it is so insulting.
It would have been much better to just say "thanks" and give nothing.
It doesn't even have to be monetary - for example, GitHub maintains a list[1] of people who have responsibly disclosed vulnerabilities, and they often send them a shirt or something similar.
[1] https://help.github.com/articles/responsible-disclosure-of-s...
Maybe. But nobody asked these guys to do a thing. Ergo, no foul.