Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PayPal.com XSS Vulnerability

seclists.org

Post reply on HN
Print view View original

31–40 of 79 posts

Re: PayPal.com XSS Vulnerability

#31

Post by [deleted] »

cperciva wrote: post #25
droopybuns wrote: post #21

Earlier quoted context omitted.

The Federal Labor Standards Act has provisions about anyone under the age of 18 working for companies whose revenue is greater than $500,000. It sucks to be a kid for a lot of reasons. This kid just blamed Paypal for one of our country's many idiotic federal laws. This choice should be considered a career limiting decision by any hiring manager.

This choice should be considered a career limiting decision by any hiring manager. Are you saying that you're holding a 17 year old student in Germany responsible for not understanding US labor laws?

[deleted]

Re: PayPal.com XSS Vulnerability

#32

Post by beambot »

droopybuns wrote: post #22
icebraining wrote: post #10

Earlier quoted context omitted.

The Chromium Security team pays bounties to adults representing minors; Paypal could have done the same.

If the feds were to audit the situation you are describing, I would wager they'd come after Google. Google has a lot more freedom and track record for asking forgiveness instead of permission than Paypal (i.e. wifi sniffing in google cars). They are not a payment processing company. This stuff is complicated. Never attribute to malice that which is adequately explained by stupidity.

Corollary: Be careful attributing to stupidity that which can be explained by laziness?

Re: PayPal.com XSS Vulnerability

#33

Post by polemic »

droopybuns wrote: post #21
ancarda wrote: post #20

Is there any legitimate reason to discriminate because of age?

The Federal Labor Standards Act has provisions about anyone under the age of 18 working for companies whose revenue is greater than $500,000. It sucks to be a kid for a lot of reasons. This kid just blamed Paypal for one of our country's many idiotic federal laws. This choice should be considered a career limiting decision by any hiring manager.

They didn't have to pay him.

Still very poorly handled. Should've gone something like:

1. "Hey, that's awesome that you found that, thanks!"

2. "For very good reasons (a), (b) and (c) we can't actually pay you, that really sucks :("

3. "But hey we like your style, so how about we fly you over for an internship when you've finished school / investigate if Germany has different rules / look at scholorship options and a great reference / [one of a million other things you could do to help a kid out"

Re: PayPal.com XSS Vulnerability

#35

Post by [deleted] »

droopybuns wrote: post #22
icebraining wrote: post #10

Earlier quoted context omitted.

The Chromium Security team pays bounties to adults representing minors; Paypal could have done the same.

If the feds were to audit the situation you are describing, I would wager they'd come after Google. Google has a lot more freedom and track record for asking forgiveness instead of permission than Paypal (i.e. wifi sniffing in google cars). They are not a payment processing company. This stuff is complicated. Never attribute to malice that which is adequately explained by stupidity.

[deleted]

Re: PayPal.com XSS Vulnerability

#36

Post by randomgerman »

droopybuns wrote: post #22
icebraining wrote: post #10

Earlier quoted context omitted.

The Chromium Security team pays bounties to adults representing minors; Paypal could have done the same.

If the feds were to audit the situation you are describing, I would wager they'd come after Google. Google has a lot more freedom and track record for asking forgiveness instead of permission than Paypal (i.e. wifi sniffing in google cars). They are not a payment processing company. This stuff is complicated. Never attribute to malice that which is adequately explained by stupidity.

Why would they come after google? A parent can make nearly any transactions for the child. And 17 year olds can take jobs, so even giving him a "job" to pay him trough that probably only would interest the tax guys ("Why are you paying some guy in germany 10k an hour" "Because we don't want to wait to long to transfer all the money" probably is problematic). If it is a problem with US law, both google and paypal have companies in the EU that could handle that.

Re: PayPal.com XSS Vulnerability

#38

Post by daurnimator »

lambda wrote: post #28
ancarda wrote: post #23

Earlier quoted context omitted.

Couldn't they just pay him once he turns 18? Or at the least reward him in some other way.

Or, pay him via his parents. Somehow we manage to have child actors get paid by movie studios; there must be a way for them to be able to pay children bug bounties, if they actually wanted to.

Child actor are specifically excluded from many labor laws; they also have a whole different set of special laws just for them.

(Obviously this is country/state specific)

Re: PayPal.com XSS Vulnerability

#39

Post by Karunamon »

droopybuns wrote: post #21
ancarda wrote: post #20

Is there any legitimate reason to discriminate because of age?

The Federal Labor Standards Act has provisions about anyone under the age of 18 working for companies whose revenue is greater than $500,000. It sucks to be a kid for a lot of reasons. This kid just blamed Paypal for one of our country's many idiotic federal laws. This choice should be considered a career limiting decision by any hiring manager.

Wait, it's considered "working for" when there's no employment relationship of any kind?
Post reply on HN