Voliokis
Joined 6 years ago
Joined 6 years ago
https://en.m.wikipedia.org/wiki/Product_binning
Iirc, early Celeron were often just Pentiums with defective (and disabled) cache
https://www.newyorker.com/news/amy-davidson/edward-snowden-t...
https://phys.org/news/2016-07-wikileaks-nsa-leaker-edward-sn...
https://edition.cnn.com/2014/01/23/us/edward-snowden/index.h...
https://www.dallasnews.com/news/politics/2013/06/12/try-nsa-...
https://abcnews.go.com/Blotter/nsa-leaker-edward-snowden-fai...
https://www.france24.com/en/20140807-snowden-russia-nsa-resi...
https://www.newsweek.com/edward-snowden-latest-nsa-leaker-wo...
Check the dates. Most of them are from before Trump, and the last one is long before Trump floated the idea of pardoning Snowden.
And you'd be surprised what kind of old hardware still works on W10.
Shouldn't people like you be able to do this for a living if you want to? It's valuable work. It has real market value. It seems like you're doing this for fun and genuine interest and I do admire that. Maybe you don't want to taint your motivation with the idea of "how much money can I get for this?" I get that too. But as an outsider, I see this low pay-out and I see exploitation under the guise of "doing the right thing". I genuinely want you to be paid more. You deserve it.
I feel like the only way this kind of thing will change is if people are more vocal about how inappropriate the low compensation is for a company like Slack. Public criticism is necessary and, unfortunately, the only tool we have nowadays to effect change. I understand if this isn't a hill you want to die on, but I hope that other people (particularly people who aren't in bug hunting) are willing to pressure Slack to reconsider its policies.
The problem with "others will ignore it in the future and ultimately they lose" is that it's a passive signal that is too easily overlooked and ignored. It never reaches anybody with any kind of influence who can make changes. If a big exploit happens and somebody does a root cause analysis, it's never going to lead to the conclusion that "well, it's because we haven't been paying enough in our bug bounty program, we need to change that", if only because there's no data about how many people passed on helping them out because of the low payouts.
The problem with starting with the baseline of "the right thing to do is always to disclose the vulnerability to Slack regardless of how little they pay" is that it perpetuates the exploitation of legitimate and important work by skilled workers. The onus should be on Slack to provide fair compensation, not on people doing this important work to "do it out of the good of their hearts".
Slack as a company had a revenue of $401 million last year and the average payout in their bug bounty program is $1376 (https://github.blog/2018-03-14-four-years-of-bug-bounty/). That's just disgusting.