What's a security flaw worth? $12.50 according to Yahoo
Yahoo has raised the ire of security researchers after handing out a measly $US12.50 each for flaws found in its websites.
Web and software companies offer so-called bug bounties, paying third-party security researchers for flaws they find in their products. Google, for example, regularly pays out bounties in the hundreds or thousands of dollars.
Security firm High-Tech Bridge decided to see how long it would take to find a vulnerability on a well-known site and have it fixed, and how much it would earn. Last month, it found a cross-site scripting (XSS) vulnerability on a Yahoo marketing site - uncovering the flaw in only 45 minutes of research. Yahoo, to its credit, responded to the security firm's email report within 24 hours, but said the flaw had already been reported, so no reward was forthcoming.
