$3k for the facebook review bug. that's a little bit too much - update thanks for the downvotes guys. keep up the good work
This bug actually seems quite critical imo, defeats the purpose of a feature and permits abuse/cheating
Race conditions on Facebook, DigitalOcean and others (fixed)
21–30 of 90 posts
Re: Race conditions on Facebook, DigitalOcean and others (fixed)
#22It would be cool if there was a browser addon that let you submit a form N times in parallel.
I do a lot of App Sec related things and I actually use mostly Chrome dev tools and command line instead of burp and other tools. The way I reproduced the bug when it was reported was by using the "Copy to curl" feature in Chrome, and then using it as follows
for i in `seq 1 16`;do
curl.*& #copied from chrome dev tools. & to background
doneRe: Race conditions on Facebook, DigitalOcean and others (fixed)
#23No bounty for bug report? Should at least have a nominal fee of $100 (else no one would bother to report it).
I agree. If I had my own company I would surely provide some incentive for bugs found in the product. Whether that incentive was monetary, a free membership, etc. I think it's important to acknowledge that all software systems are imperfect.
Re: Race conditions on Facebook, DigitalOcean and others (fixed)
#24$3k for the facebook review bug. that's a little bit too much - update thanks for the downvotes guys. keep up the good work
Who are you to say that it's "too much," when it's their money than they can spend as they wish?
Re: Race conditions on Facebook, DigitalOcean and others (fixed)
#25$3k for the facebook review bug. that's a little bit too much - update thanks for the downvotes guys. keep up the good work
Who are you to say that it's "too much," when it's their money than they can spend as they wish?
> seems
> too
> much
relax guy nobody here is angry at the amount he made
Re: Race conditions on Facebook, DigitalOcean and others (fixed)
#26$3k for the facebook review bug. that's a little bit too much - update thanks for the downvotes guys. keep up the good work
Instead of questioning why others are getting so much, question why you're getting so little.
chill out man. you are turning this into something personal. it was only a comment at the amount he got for cheating the review system. even the OP said he wasn't expecting that much.
stop jumping into the hate wagon everybody
Re: Race conditions on Facebook, DigitalOcean and others (fixed)
#27$3k for the facebook review bug. that's a little bit too much - update thanks for the downvotes guys. keep up the good work
The bounty actually surprised me, too. I expected between $1000-$2000. That is one of reasons I like reporting bugs to Facebook - they pay really good, critical bugs are fixed really fast ( One time they paid me $5000 for a bug I never could have found, but they did internally based on my low severity report. ( http://josipfranjkovic.blogspot.com/2013/11/facebook-bug-bou... )
congratulations on both findings
Re: Race conditions on Facebook, DigitalOcean and others (fixed)
#28I actually fixed the issue that was reported to LastPass. I could be mistaken but I believe he reported the security issue through our regular support channel which is why it took three days to see (instead of our security channel). From the time I saw it, I fixed it with the patch going live within an hour or two. When I DID see it, tried it myself with a quick shell script that that curled and backgrounded the same…
BTW: I just subscribed to LastPass a few days ago. I'm pretty happy with the service.
LastPass is awesome but I hate their website login process! It bothers me to no extreme that if I type in my email address with a wrong username, it pops back with, "Invalid password" while typing in a obviously random email, it pops back with a "Unknown email address. Would you like to create an account now?."
I worry that a malicious attacker could finger the service for potential victims.
Re: Race conditions on Facebook, DigitalOcean and others (fixed)
#29No bounty for bug report? Should at least have a nominal fee of $100 (else no one would bother to report it).
The economics of bug bounty programs could lead to misaligned incentives. Because the overhead cost to validate and communicate around bug reports isn't zero, the % of non-bugs submitted could become imbalanced because it is free to submit.
In most systems the reward is zero, so you can infer if a person has taken the time to submit a bug report it is because he/she is invested in seeing it fixed.
Context: I work at a decent sized company in SV on this type of problem.
Re: Race conditions on Facebook, DigitalOcean and others (fixed)
#30Earlier quoted context omitted.
Instead of questioning why others are getting so much, question why you're getting so little.
chill out man. you are turning this into something personal. it was only a comment at the amount he got for cheating the review system. even the OP said he wasn't expecting that much. stop jumping into the hate wagon everybody
Perhaps Gigablah was trying to be helpful?
HN can be frustrating if you provoke it. The problem isn't so much what you said as how you put it: the combination of dismissive tone and superficial content puts readers here on edge, because too many comments are like that and we all find them annoying. As a result it's easy to have your good intentions misread. If you had explained the thought process behind your comment, I think it would have been received better.