> If the reporter is trying to get paid for not reporting, that's blackmail.
That's not what happened here and isn't usually what happens, though? The reporter usually gives a timeline for fixing the bug before reporting externally, and often extends that deadline if it's clear the Company is working on it. This is separate from bug bounty payments.
> The more you pay people to find them, the harder they look...
> From a distance, white hat "vulnerability disclosures" start to look like a protection racket.
A pretty big distance.
If a mobster threatens to burn down a building unless you buy their "insurance", that's a protection racket.
If someone finds a major fire code violation and threatens to tell the fire marshal about it unless they fix it within a certain timeframe, that's not a protection racket, even though there's technically a threat involved. If the building owner is a dick about it, then next time that person will probably just go directly to the fire marshal.
Everyone I know who bikes in the city has been hit by a car at some point (see: my complaints about enforcement of traffic laws in this thread if you want my opinion on that).
I cringe when I see parents with their kids on the back of their bikes. Super dangerous.
While I'm obviously exaggerating by saying "never", the list is much smaller than it needs to be, and you have some misleading things on that list.
Chinatown subway station is great. Better connects SF residents and it's exactly what I want to see more of in SF.
- Van Ness BRT? That project started in 2003. It took 20 years to complete. Not exactly the poster child of solid transit improvements in SF, except if you ignore how it got there.
- The Caltrain electrification project is great for the environment, but doesn't help SF much as far as improving transit availability. It's slightly faster, at least.
- BART expansion to Berryessa is a bit separate from SF transit improvements, which is what I'm talking about.
- Salesforce transit center is fine and has good vision, like expanding caltrain downtown. But doesn't add a massive amount of transit availability that wasn't already nearby (yet).
Sounds right. Here in SF, instead of police pulling over people who speed and run stop signs, we're getting rid of parking spots within 20ft of intersections so people speeding and running stop signs can see if they're about to kill a pedestrian.
Could raise a fortune for public transit if we enforced traffic laws and used that money.
There was a ton of flooding on flat roads and highways during the last week+ long storm session. I saw several lanes impassable on 101, and several spots in SF where a car could easily have gotten flooded.
All the alerts I got were basically "please don't drive" and not "you're gonna die!", which I think is totally reasonable.
That's not what happened here and isn't usually what happens, though? The reporter usually gives a timeline for fixing the bug before reporting externally, and often extends that deadline if it's clear the Company is working on it. This is separate from bug bounty payments.
> The more you pay people to find them, the harder they look...
Yeah... that's the point...