franjkovic
Joined 13 years ago
Karma
1,114
Submissions
44
Member since
Oct 20
Recent submissions
Comment · 10 years ago
Every Twitter's bounty amount is divisible by 140.
Comment · 10 years ago
I wanted to move from Blogspot to a personal domain, but kept delaying it for a long time.
Comment · 10 years ago
>how many hours did you spend researching this?
Two to three hours discovering and writing the initial report, couple more hours (unsuccessfully) trying to escalate it using pre-approved apps.
>I think $5,000 is a joke
This is still $5,000 more than I would get reporting a similar bug to 99.999% of companies, and I am OK with the bounty. Here is good comment on the topic of bug bounty rewards: https://news.ycombinator.com/item?id=11249173
Comment · 10 years ago
The bug was reported on December 8th, 2015 and fixed on February 18th, 2016 which is an unusually long time for Facebook. The bounty reached my account during the middle of March, but Facebook has recently changed their bounty payment processor to Bugcrowd, and now they have weekly payments.
Comment · 10 years ago
The post is interesting, but I do not know why people assume they would get a bounty for a security report if the company does not have responsible disclosure / bounty program.
Comment · 11 years ago
I'd say it does.
Not interact with other accounts without the consent of their owners.
Edit: whoops I mis-read this a bit, but the point still stands - he escalated using AWS keypair that did not belong to him, and he had no consent of the owner.
My security blog: https://www.josipfranjkovic.com