If you want to get paid market rate for the value you provide as a security researcher, then stop doing work on spec and just hoping that someone compensates you for it.
Standard practice to deliberately insult a waitress is to leave a short tip. That's more insulting than leaving nothing.
And in this case both the "a token of our appreciation" and "short tip" practices could been "meant", and were as a matter of fact taken as "meant" by the sender and receiver respectively.
Just in case you want to know where I stand: if I find $100K in cash and there is no way to trace it back to me I'm not returning it. However, that is different to finding a bug and selling it for monetary gain.
YES!
There seem to be two camps here, neither of which can even fathom the other's position.
On your side, we have people who do a purely logical comparison that non-zero is greater than zero, so this is better.
On my side, we have people who inherently separate tasks done for free for fun or just to be nice, from tasks done for money. For these people, getting paid a pittance is a grave insult, while not getting paid at all (when nothing is owed) is just fine.
I don't really know how to explain it any further. I think the people in your camp just need to understand that the other camp exists and contains a lot of people, and that regardless of logic, giving someone a $12.50 gift card is a massive insult, far worse than giving them nothing. You don't have to understand why, but you have to know that this is how it is for a lot of people.
It seems like there are just two distinct modes. When you do something for free, you're basically doing a favor, and you get pleasure from being altruistic. Once you get paid, it's now an exchange of value, not altruism, so you only get pleasure from being paid. If the pay is small, you'll feel upset because your end of the bargain is based entirely on that, while if you're doing it for free, you switch over.
I could be full of it....
When they traded a shirt for the report Yahoo was implying that they no longer owed him anything, it was a fair barter
Basically, no monetary reward is necessarily expected here. But once you give one, it is a faux pas to give one that looks small in comparison to what is considered the "norm." We even have common insults reflecting this fact, where bragging about something I impressive will invite comments like, "Wow, here is a shiny nickel." The impromptu offer of a clearly paltry reward is understood as a slight.
I think the problem mostly lies in conflating "token of gratitude" with "gratitude". The token is a cheap thing, and has some small monetary value. The gratitude itself is a much more valuable thing, for both the giver and the receiver. Reporters are motivated by doing the right thing, and perhaps getting some recognition for their contribution. The recognition has two parts: recognizing cleverness (you caught something others missed), and recognizing honor (doing the "right thing", reporting it to the affected party rather than exploiting it yourself).
You can't put a price on cleverness and honor. And if you try to, and you come up with $12.50, then you're an idiot. The only thing you can do is recognize it, and show gratitude for the help.
What the OP tried to do was show gratitude and recognition with a token, and some recipients confused the token for the gratitude. It doesn't sound to me like the giver was confused! E.g. he wasn't saying "Here, let me pay you for your time, eliminating the need for us to recognize your cleverness and honor for the cost of a T-shirt." Now you might say that the token was poorly chosen: there is a reason people invented trophies, items that are totally worthless other than as tokens of accomplishment. It's because the recipient will NEVER confuse a trophy for the price of the accomplishment behind it.
Personally, I think a cool little useless trophy would have worked better, and certainly no gift certificates! Being named and honored somewhere on the Yahoo website would be great. Giving a small cash prize, like $1000, would be a classy move.
The bottom-line remains: there was nothing fundamentally wrong with the T-shirt-as-trophy, apart from the (apparent) risk of recipients confusing it for T-shirt-as-payment.
As best I can tell, the gift card was offered without comment. And while the intentions were good, the lack of such a message meant that it was taken badly.
I guess the lesson is, if you're offering only a token of appreciation, make sure the recipient knows you know it's only a token.
Sure. But given the lack of a formal bounty program at Yahoo!, it was a poor choice to pick them as a place for "tasks done for money"
Yahoo's reaction put it into the "paid" category, and then paid an insultingly low amount. That was their error. A different reaction, even just different wording when sending the gift card, could have put it into the "free" category.
If something is given, then they are acknowledging that their thanks/recognition is not enough, but that $x monetary value makes up the difference.
Some people take it as an insult that if thanks isn't enough, they can be 'bought' for $x, where $x is $12.50, or whatever. The reasoning is basically that if you are saying the time taken to reproduce and report the issue is important enough to compensate, you should probably compensate commensurate with what they would expect to make for their time/expertise.
I think most people who report these things do so because they want to improve things, not for the money, so most probably fall into the first camp, but I can understand where the second camp is coming from.
Yes. Giving nothing doesn't give any indication of value - maybe the work is very highly valued but it's not Yahoo's policy to compensate. Fair enough.
Giving a cheap gift attaches a very particular value.
There is a body of research on this, e.g. http://ideas.repec.org/p/zur/iewwpx/007.html
"rewards undermine the intrinsic motivation of volunteers." "a large literature in social psychology [emphasizes] that external rewards can undermine the intrinsic motivation for an activity"
The problem is when the worlds of social norms and market norms cross. The book gives the example of Thanksgiving dinner, and what would happen if you offered your mother-in-law a couple hundred dollars to pay for the meal at the end. Another example is sex: paying for sex makes it a very different situation. (Also note the difference between giving someone flowers on a date and giving someone cash.)
The book describes a research experiment, where participants were paid $5, 50 cents, or nothing to perform a short task of sorting shapes. The people paid $5 sorted 50% more shapes than the people paid less (since they were more motivated), but the people paid nothing did the most of all since they were motivated by helping out the researchers.
This ties in with intrinsic vs extrinsic motivation - if you're getting paid, it's extrinsic motivation, and then you're motivated by whether you're getting your money's worth.
(There's a lot more, but I don't have time to get into it, so check out the book.)
The point is, that if people report bugs for free, it's part of the social norms world, where they are keeping the world safe, making it a better place, etc. If they are getting paid, it's part of the market norms world, and they expect to get paid what the bug is worth. With Yahoo, the lines got crossed: giving a T-shirt is generally part of the social norms world, but giving a $12 gift certificate crosses over into the market norms world, and $12 is insultingly low. This is why it would have been better for Yahoo to give nothing.
Imagine you ask a friend over to help fix your car in exchange for beer. This would clearly not be interpreted as payment, but as a way of saying thanks. Now suppose it turns out they generally like beer but hate the particular kind you purchased, so you feel bad and give them $10 to buy themselves a beer they like. Suddenly, thinking you were doing something nice, you've crossed into market norms.
This, as far as I can tell, is basically what happened.
He tried to leave the $0.25 as a tip. She said, "Oh, no, you must need this," and gave it back to him. Her clear view was that no tip was better than $0.25. I congratulated her, and made up for his idiocy with my tip.
If you don't tip at all, you're either clueless or an asshole. Tipping a quarter is more insulting: you're acknowledging the need to tip, but making it clear you don't think much of the bartender.
I was at a company where someone reported a security problem to the support team. I didn't quite believe it, but they got me on the phone, and within 10 seconds the guy had said the right words to tell me he had found something. So we fixed it.
What then? The company had no formal bounty system in place. I said we should send him something, so I got him an Amazon gift card and sent it to him along with a letter of thanks.
He said thank you back to us.
It all seemed good, but maybe it was just luck of the draw that an Internet mob didn't show up for me the next day.
I think it's great they are making a policy change, and making it retroactive even. My opinion is facing the community and the perceived entitlement people have at getting something for reporting a bug. I applaud those that have policies in place, but the community is shining a bad light on itself with the outrage.
Every act an employee takes and every word they speak while on the job is directly attributable to their employer. No exceptions, no excuses, ever. It doesn't matter if it was against policy, and it doesn't matter how many employees there are. The company must take responsibility. It reflects extremely poorly on the corporate culture of Yahoo and Tumblr that you don't recognize that.
You fail to understand two things. The first is that you have no such "right". You are speaking as a representative of your employer when others perceive you to be. What you or your employer think is irrelevant.
The second is that this isn't about you. Whether you must take responsibility internally is up to your employer. But whether your employer must take responsibility in public is not. It has nothing to do with your "rights". You don't have a say in the matter.
Could you please explain your logic there?
That's how I see things from the outside, I don't have any inside information and it could very well turn out they have most of their staff working on software testing and security.