You have to please the developers.
why would i, as a developer, care if i could install a custom firmware? wouldn't i want to be testing my game on the firmware that's going to be run by 99.999% of users?
really, i'm asking.
There's no reason why they shouldn't be able to get this to work.
it's a massive engineering effort, and they admit as much in the article. even if you 98% of the things working, the last 2% is going to cause unacceptable app crashes.
think about the engineering effort to take the entire iOS *and* Android SDK, plus the Google APIs, and make them all work with MSFT. that's not just string manipulations, it's all of the APIs that connect to cloud services, sensors, and so on.
Why would anyone need to reverse engineer open source libraries from Android?
because they are also providing MSFT implementations of the Google APIs which of course are not open source. should be easy enough. e.g., provide a maps implementation that works exactly like Google maps.
man what a terrible, awful ad.
how does seeing a scuzbag loser in his underwear barf all over the floor to the point that he fills up his room, then pull his tongue out in the process pulling his spine out and ending up in a puddle of boneless flesh floating in the puke leave me with a good feeling about this product?
That's because most people with great ideas are bad at business.
okay, but that's not what happened here. Ouya was a mediocre Android device with a controller and very few games that took advantage of the controller. it's claims of openness, even if true, excited hackers but not consumers or game developers.
all of that crap you quoted about custom firmware and open recovery mode has zero to bearing on their financial status and problems. the employee is right, almost no one, relatively speaking, is going to base their decision to purchase an Ouya on whether it supports custom firmware.
the truth is that it was some amount of engineering and support to give customers the whole enchilada, and they were already struggling and didn't have the resources. don't start reading malice into the situation.
sounds like you purchased on ouya, so welcome to the world of broken promises that is kickstarter.
really? what message would paying him send?! if you find 3 vulnerabilities, go ahead and expose 2 of them. ruin our business. no problem. we'll pay you big bucks for the one you didn't release.
and IMHO, why would they? he did them wrong, very wrong. they shouldn't reward him for that. consider it this way. the potential harm of publicly exposing the issue is massive. you seem to be claiming it's a zero. it isn't. it's a negative -1,000,000,000. 30 - 1,000,000,000 is a negative number. he's far from being in the black in the good will department.
the bug bounty program isn't a formal agreement bound by law. it's completely at the discretion of the sponsor company. that means that if they don't like your actions, or just the cut of your jib, they don't *have* to pay you. maybe the CEO saw your dog poop on his lawn. yep, no payment. welcome to life.
And you can always just take a standard gun and bend the barrel. Yes, it works.
so all that R&D on the corner-shot weapon was for nothing? common sense to the rescue.
if it were 30 separate exploits, you would pay him for 30 exploits, and charge him damages for the 1 that got away.
man, life, you're new to it huh? good luck when you leave you mom's basement and discover that's not how life works.
you're driving
big negative there. it's more distracting to try to read a text on an ultra small screen than it is to just pull our your phone.
i've had an android wear watch for 3 months. the biggest thing i use it for? a watch. it is interesting and fun being able to pick / design your watch face. is it worth $300? very dubious.
he fact that the disclosure post was removed quickly may indicate wrongdoing, that he realized he messed up. So, fine, remove the disclosed vulnerabilities from the bounty, but still pay the bounty for the others.
sometimes when you f-up you just have to eat it. accept responsibility and the outcome of YOUR mistake. behavior like this is a side affect of the having parents that never let your learn lessons the hard way. lost your iPod little Johnny? we'll buy you a new one. i don't blame him for being upset. anyone would be upset. but it's his mistake.
If he had submitted each issue separately they would have paid the others that he didn't disclose.
almost certainly not. they are not paying him because he did something very irresponsible. he did exactly what that the bounty program is trying to prevent. it's like if you offered someone $20 to wash your car, which they did, but then threw a bucket of mud on it. would you still pay them the $20?
for one exploit that was refused, how is it legitimate to deny the bounty for the other 29?
because life's not completely disconnected like that?
because you don't pay someone that publicly exposed exploits without giving you a chance to fix them.
say you paid a guy to mow your lawn for $20 and wash your car for $20. he does a fine job mowing your lawn, but in the process of washing your car he breaks your windshield and slits your tires (maliciously, and offering no compensation). would you pay him for mowing your lawn?
Except this only works a couple times. Who is going to spend their time on Groupon now that they know they'll weasel out of paying?
groupon would rather bugs not be reported at all than having them posted openly on the internet before they have a chance to fix them. anyone would. this guy did them a major disservice.
Groupon could hire people themselves to find the vulnerabilities, but they chose not to, instead they offer a bounty for security bugs, which apparently is very cost effective when they don't pay up, so it's a double win
maybe you aren't familiar with how bug bounties work. it's when a company pays a finder for *privately* reporting issues before they are discovered publicly. this guy did both. he reported it privately when went on to disclose it publicly. you think a company should reward someone for disclosing security vulnerabilities publicly before they have a chance to fix them?
Not only is UNIX dead, it's starting to smell really bad. -- Rob Pike
