11–20 of 60 posts
This is the same guy who hacked GitHub (and Rails) with the multiple assignment hack, among other things.
homakov is as famous as PG on HN.
On HN? Or somewhere else (if so where?) where he is "as famous as PG on HN".
If you mean he is as famous on HN as PG is on HN I don't think that is the case.
Companies without bug bounties don't deserve responsible disclosure? Twitter has a pretty clear way to reach them, and recognition is given on their page. If recognition isn't sufficient for responsible disclosure, how much money would be enough? I think bug bounty programs are great, but I don't think they should be mandatory.
Come over to App.net. It will be a while before the masses ruin that. Free invite link >> https://join.app.net/from/fjjgdclsjq
Earlier quoted context omitted.
homakov is as famous as PG on HN.
Where is he "as famous"? On HN? Or somewhere else (if so where?) where he is "as famous as PG on HN". If you mean he is as famous on HN as PG is on HN I don't think that is the case.
* How famous PG is in HN
* How famous homakov is in HN
> I wrote a full disclosure post 5 minutes after finding the bug because twitter doesn't reward "bounty hunters". Companies without bug bounties don't deserve responsible disclosure? Twitter has a pretty clear way to reach them, and recognition is given on their page. If recognition isn't sufficient for responsible disclosure, how much money would be enough? I think bug bounty programs are great, but I don't think th…
That seems to be homakov's view, yes, and I can't say I don't understand his view.
Some of the experience elements of DM have been fixed on the iPhone, but last I checked, the problems on web desktop made me so annoyed that I stopped using DMs altogether.
> I wrote a full disclosure post 5 minutes after finding the bug because twitter doesn't reward "bounty hunters". Companies without bug bounties don't deserve responsible disclosure? Twitter has a pretty clear way to reach them, and recognition is given on their page. If recognition isn't sufficient for responsible disclosure, how much money would be enough? I think bug bounty programs are great, but I don't think th…
> Companies without bug bounties don't deserve responsible disclosure? That seems to be homakov's view, yes, and I can't say I don't understand his view.
> I wrote a full disclosure post 5 minutes after finding the bug because twitter doesn't reward "bounty hunters". Companies without bug bounties don't deserve responsible disclosure? Twitter has a pretty clear way to reach them, and recognition is given on their page. If recognition isn't sufficient for responsible disclosure, how much money would be enough? I think bug bounty programs are great, but I don't think th…
> Companies without bug bounties don't deserve responsible disclosure? That seems to be homakov's view, yes, and I can't say I don't understand his view.
If you seek out bugs in a company's code with the expectation that you'll be rewarded for it, and then the company fails to reward you, I can see that it might be perceived as unfair, especially if the company indicated that such an expectation was reasonable.
If you happen across a bug in a company's code, and then publicize it because they aren't going to pay you money for it, that seems a little more like "blackmail." People really shouldn't orient their moral systems around money.