Swag packages like these are a token of appreciation not a reward.

The front page post in HN here is worth far more than few thousand dollars , don’t think either organization is operating under purely financial transactional nature .

Most people who find a dropped wallet will return it without evaluating the market value of your compromised identity or the contents of the wallet .

Grateful owners may buy you a beer that doesn’t make them cheap , not everything is evaluated in purely money terms, and that is a good thing ?

▲

r_lee 3 hours ago | parent | next [-]

> The front page post in HN here is worth far more than few thousand dollars , don’t think either organization is operating under purely financial transactional nature .

not always, especially if its just someone independent. iirc there was a guy here not too long ago who started dropping Windows 0days because Microsoft couldn't be assed to process his bug reports

	▲	OkayPhysicist 2 hours ago \| parent \| next [-]
		That actually supports the point that people aren't acting under purely financial motivations. If the guy was purely following financial motivations, surely he would have chosen to sell the vulnerabilities to the shadier side of things. Instead, he dumped them publicly, burning their value while amplifying the "fuck you" factor to Microsoft. Ignoring reports, or just fixing the vulnerability without acknowledging the work put in by a researcher, is rude and invites rudeness in return.
	▲	ivlad 2 hours ago \| parent \| prev [-]
		Microsoft runs a bug bounty program. NightmareEclipse (that’s the researcher’s handle) allegedly participated and Microsoft did not honor their part of the bug bounty program terms. This is a completely different situation - a company evaluates the security of a prospective vendor prior to entering a business agreement.

▲

flaunf221 3 hours ago | parent | prev | next [-]

Wallets usually belong to real people with lives. We can empathize with them. Companies are not people. And they also don't and can't empathize with you.

▲

manquer 4 minutes ago | parent | next [-]

[delayed]

▲

alluro2 3 hours ago | parent | prev [-]

"and can't empathize with you" - I don't really understand why such a perception of companies has been regurgitated and reinforced so much in US public, to the point where it's a blank excuse from ever expecting such a thing from a company. It's not true that it can't. The only reason to keep repeating that kind of worldview is to absolve companies behaving in shitty, toxic or downright evil ways.

The law doesn't say companies MUST choose the most profitable choice at every turn, and even explicitly allows for good treatment of customers, community, employees etc as a viable business strategy (even if it's sad that it must be justified in that way).

▲

scubbo an hour ago | parent | next [-]

> The only reason to keep repeating that kind of worldview is to absolve companies behaving in shitty, toxic or downright evil ways.

Or...to warn people away from ever expecting compassionate or empathetic behaviour from companies, and remind people not to trust them?

	▲	sublinear 30 minutes ago \| parent [-]
		I think the only misleading part of this situation is your naive and self-centered definition of "trust", and the assumption that so many others think similarly enough that they need to be warned. I trust a business to fulfill their obligations as stated in writing for the money paid. I do not trust them in any other way. Nobody should "trust" or depend on undefined behavior. Common sense can only ever be as common as you expect.

▲

awesome_dude an hour ago | parent | prev | next [-]

I agree that this notion that companies make these decisions is bad, bad on the grounds that it's people working for those companies that make the decisions, they hide themselves away, but the company itself isn't doing anything - is always a human making the decision

▲

ImPostingOnHN 2 hours ago | parent | prev [-]

I think the point is that companies are purely legal entities, and as such, cannot feel, much less empathize, simply by virtue of them not being living things

	▲	leptons an hour ago \| parent [-]
		That's nonsense. "Companies" are not something non-human, they are run by humans, who do feel, empathize, and are living beings. Without these living-being humans, there would simply be no "company". Now how those humans that run the company behave is another thing - they are free to be greedy assholes, and a lot of them are, and some of them aren't - but that's still a human thing.

▲

4 hours ago | parent | prev | next [-]

[deleted]

▲

sublinear 4 hours ago | parent | prev [-]

Thank you for pushing back on one of the top disruptive bad-faith comments we see on HN.

The follow up arguments will be that since billion dollar companies ultimately only care about their bottom line, so should we.

I'm certain most of these comments mean well (to "open eyes" or whatever), but some of them really are on principle and blatant astroturfing.

▲

r_lee 3 hours ago | parent | next [-]

> The follow up arguments will be that since billion dollar companies ultimately only care about their bottom line, so should we.

so it should be fought by giving them free work in the hopes that they'll finally feel guilty and then start paying proper bounties?

like to me that just seems funny, as if they'd change anything if we'd keep rewarding them for not doing the right thing

like, there's a reason regulation exists for all kinds of shit because otherwise companies would do all kinds of atrocities in hopes of cutting costs

	▲	sublinear 2 hours ago \| parent [-]
		At some point, you will realize two things. First, you're being petty and just fighting fire with fire. Second, most of this research is fairly trivial. What you're instead encouraging is a race to the bottom. You're not going to kill off the companies you hate by withholding information. You don't even have that power anyway because by its very nature, security research is not secret. You're really just encouraging pessimistic groupthink and bad faith. This is why businesses can't be more open about their flaws. It's not that they're stupid and incompetent, but that the pitchforks come out. These are the seeds of dystopia. They would have eventually figured it out, but as an unfortunate incident with an outsized effect. As much as you wish it to be true, even the worst of these incidents will not kill their business. As much as you hate these businesses, their financial momentum will eventually cause the public to depend on them more. There's more at stake here than anyone's personal gain. It's naive to think otherwise. You're just manifesting broken windows and ignoring litter thinking you're fighting the man. This is straight up ghetto punk ass behavior wearing a white collar.

▲

jazzpush2 4 hours ago | parent | prev | next [-]

It's nice to wax poetic, but they should absolutely pay the researchers here.

▲

2 hours ago | parent | prev [-]

[deleted]