"Pocket does not provide monetary compensation for any identified or possible vulnerability."
Cheapskates. This could have cost them money if somebody abusive had discovered it first. He deserves a monetary award.
[edit] Should we be concerned about the massive number of people listed on that page who have found security problems with Pocket? I counted 153 separate people...
It's a freemium service that doesn't depend on ad revenue. Maybe they're not made of money as Facebook and Google are and that's the reason for not compensating.
This isn't some free service being run out of the goodness of somebodys heart. This is a company, that wants to make money. If a company has that many employees, they can afford a bug bounty program too.
I didn't say it was being run out of the goodness of someone's heart. That's why they need money, to pay the bills. Having infrastructure to deal with that many users on a popular service doesn't come cheap.
Mozilla claims that they don't get money for the integration, and I don't see a good reason why I shouldn't believe them. Pocket very likely doesn't have that much money lying around, compared to Mozillas budget.
its sounds a lot more like the situation was "Pocket was friends with some guys at mozilla, and they made up a bunch of bullshit about how it was a benefit to users to push their buddies project"
"Mozilla bundles crapware for financial gain" v. "Mozilla bundles crapware without any financial incentive" is a more accurate comparison, and highlights that something is indeed wonky over in Mozillaland.
Yes, but Pocket is integrated with Firefox. Pocket and the Mozilla Foundation formed a partnership that almost certainly includes some sort of compensation or resources in exchange for Pocket's service.
Yes. Notice the corollary: if they had a bug bounty, we wouldn't be learning about this today, because someone who wants to make money probably would have already found them.
You shouldn't do work based on "they haven't had a bug bounty before now but maybe they will make one just for me."
Exploits in a proprietary cloud service like this are harser to sell, at least se acquisition programs are expressly uninterested in them. I wonder what effect that has on bug bounties
They also don't really seem to put much effort into releasing bugfixes in a timely manner. For a month and a half, you could reboot any iPhone in the world remotely via text message.
Heaven forbid we ask of a corporation that they compensate us for a job they should have done and preventing huge losses and a PR nightmare.
Had I been OP I would have sold the exploits with no remorse, we don't need companies like that on the market, rewarding corporations for bad behaviour with free labour is fucked up on every level.
Maybe they should have a bounty program, but they don't, and they made that clear. They didn't ask anyone to perform "free labor," and I don't think they have any obligation to pay for labor they didn't ask to be performed. I don't see anything unethical in their behavior. Your beef seems more to be with the researcher who decided to perform free labor for this company.
Selling exploits to the black market does strike me as unethical, though.
>Selling exploits to the black market does strike me as unethical, though.
If I gave them away and they get exploited is it unethical? If I gave them away publicly vs privately does it make a difference? If I responsibly reported to the manufacturer a month previously?
I guess intent matters, and I'm ok with that being the line. In the end though I feel the rewards for fast production far outweigh the consequences of security bugs. My firefox updated last night and added pocket and I was reminded that I couldn't even remove the useless bloody thing.
> If I responsibly reported to the manufacturer a month previously?
I'm not an expert on responsible disclosure, and I think reasonable people can disagree on the best course of action. I think selling exploits on the black market is always unethical.
> I couldn't even remove the useless bloody thing.
I'm a photographer and freelance software developer, I know all about not doing work for free and what that does to our industries.
This isn't doing work for free, this is a hobby. The time spent by this person was not requested by Pocket and they shouldn't be maligned just because they're not paying him.
Also, "sold the exploits with no remorse" really makes you sound like a troll. So I'm feeding.
If you're that worried about compensation, the correct answer is to determine up front whether there's a bounty program, and if not, move on. Not to do work you had every reason to believe would not be compensated, then complain when it isn't compensated.
You can ask them for a bounty program in the future, but you don't really have a right to get upset when they don't honor a bounty that was never promised. It's like demanding a reward for returning a dropped wallet.
Okay, so forget the word felony. "You would have aided/abetted a malicious criminal and profited monetarily by doing so?" My point is that selling an exploit doesn't become morally okay just because the company doesn't offer a bounty.
You say it's subjective and then the reason you give is that some people would, knowing that it's criminal, still commit a crime.
It looks like their view of the activity isn't that it's fine to do, rather that they don't care that it's not fine. This implies that they know and accept that it's not fine.
"Pocket does not provide monetary compensation for any identified or possible vulnerability."
Cheapskates. This could have cost them money if somebody abusive had discovered it first. He deserves a monetary award.
[edit] Should we be concerned about the massive number of people listed on that page who have found security problems with Pocket? I counted 153 separate people...