201–210 of 454 posts
The NDA is not a valid contract because there is no consideration. For a contract to be valid each party has to gain something. This is why many contracts include a token consideration of $1. This one didn't, so it's invalid.
P.S. It might be of limited correctness, only in some states, in the USA. I'd suggest you don't talk people into signing perfectly valid contracts hoping for an unlikely loophole.
About a month ago I noticed that my bank had a vulnerability - I could access the details and photos of every remotely deposited check. I sent them an email, they took the feature offline in about 2 hours. No bug bounty but oh well.
Earlier quoted context omitted.
> However, there is a risk they would sit on zero days Unlikely. They are still here to protect americans, in a sense. Stealing money from a bank or a regular business is not on their agenda. There is a 10% of vulnerabilities that might have re-use for intelligence purpose, but it shall be alright for the bulk of it.
So what happens if you find a zero day vulnerability in a Russian bank? Not everyone on the internet is from the US.
Earlier quoted context omitted.
Consideration doesn't have to be denominated in dollars.
Consideration can be as minimal as "your continued employment with this company." It does not have to be any sort of additional dollar amount.
Edit:googled some more and it appears that continued employment as sufficient consideration is different on a state by state basis and isn't firmly set in stone yet
There needs to exist a legal entity/non-profit or company that acts as a shield and/or escrow for these kinds of situations. Basically, as a researcher you can have them deal with the company/organization for you, including dealing with any threats, collecting any bounties due, and such. The company could have domain expertise of the industry, laws, and generally be a force against these companies -- the analogy woul…
Why didn't they just give him $10K to shut up and then go fix the issue? It would be cheaper than all the lawyer fees.
Large firms wouldn't survive at high enough rates to dominate public life as they do, if they weren't underwritten by the state at every turn.
Earlier quoted context omitted.
There's a helicopter crashed in a house. I don't need to be a pilot to know it's not supposed to do that.
This is actually pretty close to how I personally define a "professional": A professional is someone whose work can only be judged by other professionals of the same domain. Obvious failure modes are exempted. Anyone can tell you about a bad bridge after it has failed. But it would take a bridge engineer to tell you that before it fails. https://news.ycombinator.com/item?id=8960822#8963307
https://www.designingbuildings.co.uk/wiki/The_architectural_...
Also, your definition includes itself as part of its own definition, which is a circular definition fallacy.
Earlier quoted context omitted.
"We won't sue you", however, is not consideration.
I wouldn't be so sure - for example, out of court settlements pretty much amount to "We'll pay you $x without admitting that we ever did something wrong, and you agree not to sue us over that thing that we totally did not do.", and these definitely are valid contracts.
In the first case you have extinguished a right that could be used against you. In the second case you have obtained nothing more than the illusion of safety.
Earlier quoted context omitted.
That was my experience when I stumbled across a text file with several thousand credit card numbers, which included tons of details about each card holder, including SSN. I tried reporting it to the credit card, and to the issuing bank, and to the FBI. The only thing I asked was that they cancel the credit card accounts and put a "potential fraud source" note on each customer's account. Each party I called was more c…
Suppose they granted your plan to "cancel the credit card accounts" and "potential fraud source" note on each account. That's pretty much trying to shut down business with their customers. You don't see how they'd interpret that as hostile? Future actors would know how to apply similar techniques if the outcome was in their favor (e.g. Anonymous suddenly produces a large file of cc#'s and threatens bank!) > The only…
That's not how credit cards work. You close that account, transfer the balance to a new card, and issue it to them in the mail. I've done it a half dozen times, and my CC company is only out for odds and ends like postage and stamping a new card.
> In fact, why were you making demands
I wrote "asked", and then you pasted that, and misquoted it as "demanded"? If you hadn't included my quote, I'd accuse you of dishonesty, but now it's just weird.
I asked them to proactively protect their customers, because my grandfather had been through hell after his identity was stolen, and I wanted to do my best to protect other people from the same.
There needs to exist a legal entity/non-profit or company that acts as a shield and/or escrow for these kinds of situations. Basically, as a researcher you can have them deal with the company/organization for you, including dealing with any threats, collecting any bounties due, and such. The company could have domain expertise of the industry, laws, and generally be a force against these companies -- the analogy woul…
Why didn't they just give him $10K to shut up and then go fix the issue? It would be cheaper than all the lawyer fees.