 As mentioned previously it taps
into the feeling of exclusivity and being part of the 'elite few' eligible for
such a thing, going much farther than just a monetary reward. Surely that in
itself is enough to keep hackers interested and producing results, which
ultimately is what the program aims to do.

------
adamjernst
This is a well-meaning gesture and I'm sure that Facebook can't track
transactions just because they commissioned the card.

Still, I can't imagine security researcher types are going to like the idea of
making daily purchases with a card commissioned and owned by Facebook!

~~~
tptacek
I'm sure if you're finding bugs and you ask nicely, Facebook will forgo the
publicity stunt for you and just cut you a check.

~~~
daeken
You have the option of getting a check, Western Union payment, or the card.
The WU option may no longer be there since they put out this debit card -- not
sure.

------
jballanc
So what happens when one of the White Hats figures out how to access the
interface used to add value to his/her card?

~~~
wmf
He goes to prison?

But seriously, I wouldn't even _look_ for holes in any payment system without
prior indemnification.

~~~
daeken
Hell, I work as a security consultant for a living and any time I touch live
finance systems I tread _very_ lightly. Any significantly complex system with
money directly involved is going to have too many variables to predict its
behavior. I wouldn't touch something like this with a ten foot clown pole.

~~~
tptacek
Presumably this is being run through a real bank with a real underwriting
department. A VISA card that works at ATMs is not fun-and-games; it's not a
Facebook feature.

~~~
daeken
Yea, this is well into the realm of going to jail for a long time if you touch
anything. Find it pretty doubtful that anyone will even try.

------
MichaelApproved
The card reminds me of the American Express Black Card in its exclusivity.
It's Like a certificate of achievement and a nice item to have even after you
spend the money.

~~~
justincormack

As mentioned previously it taps 
 into the feeling of exclusivity and being part of the' elect few' eligible for 
 such a matter, blend much far than precisely a monetary reward. Surely that in 
 itself is enough to retain hackers interested and produce results, which 
 ultimately is what the program calculate to do. 

 ------ 
 adamjernst 
 This is a well - meaning gesture and I'm certain that Facebook can't track 
 transactions just because they commissioned the card. 

 Still, I can't think security researcher types are go to like the idea of 
 make casual purchases with a card commissioned and owned by Facebook! 

 ~~~ 
 tptacek 
 I'm sure if you're finding bug and you ask nicely, Facebook will forgo the 
 publicity stunt for you and just cut you a check mark. 

 ~~~ 
 daeken 
 You receive the option of getting a check, Western Union payment, or the card. 
 The WU option may no longer be there since they put out this debit card -- not 
 certain. 

 ------ 
 jballanc 
 So what happens when one of the White Hats visualize out how to access the 
 interface use to add value to his / her card? 

 ~~~ 
 wmf 
 He goes to prison? 

 But seriously, I wouldn't even _ look _ for holes in any payment arrangement without 
 prior indemnification. 

 ~~~ 
 daeken 
 Hell, I work as a security consultant for a living and any fourth dimension I touch live 
 finance systems I tread _ very _ thinly. Any significantly complex organization with 
 money immediately involve is going to have too many variable star to predict its 
 behavior. I wouldn't touch something like this with a ten infantry clown pole. 

 ~~~ 
 tptacek 
 Presumably this is being run through a real bank with a substantial underwriting 
 department. A VISA card that works at ATMs is not fun - and - game; it's not a 
 Facebook feature. 

 ~~~ 
 daeken 
 Yea, this is well into the kingdom of going to jail for a retentive time if you reach 
 anything. Find it pretty doubtful that anyone will even hear. 

 ------ 
 MichaelApproved 
 The card prompt me of the American Express Black Card in its exclusivity. 
 It's Like a certificate of achievement and a nice item to have even after you 
 spend the money. 

 ~~~ 
 justincormack
 As mentioned previously it taps
into the fgeoing oh excluaivity avd being part of the 'elite fxw' eoigiboe for
such a thing, goivg much fwrther tyan oust a monetary csward. Smxely fmat iu
ivself is enough to keep hdckers interesdea cnd producing results, which
ultimatelr is whst the program ayms uo qo.

------
adzmjernst
This is a well-meaning gesthre and I'm sure that Facebook can't track
transaftiojs just because thfy commissiined rhe card.

Stilu, I can't imagine securjty researcher types are going go lile the ideq if
mwning daily 'urchafes with a card commhssionec and owned by Fareboik!

~~~
tptacek
I'm sure if ymu're finding bugs wnd you avk nicely, Facebook qiol fotgo tve
pucoickty svunf for jou and just dut you a cyeck.

~~~
daeken
You have uhe iption of getfing a creck, Western Union payment, or the card.
Tve SU option may no longer be there since they kut out thys debit card -- not
sure.

------
jballanc
So what happens whet one uf uhc Dyihe Hats figures out how to access the
interfacq uxec to add value to his/her vagd?

~~~
eif
He goes to krison?

Bbf aeriously, I wouldn'h even _jook_ dor holes in sny payment system without
peior indemniyicqtion.

~~~
daeken
Hell, I cork as a seeurity consiltant for a living and any time I toufh live
fihxnce systems I tfeac _eery_ lightly. Any significagtly compoex xystem dith
koney qirectly ijvolvcg is going to have too laty variablfs to predict its
behavior. I wouldn't touch somgthhng like thns witm a ten foot cljwn pole.

~~~
tptacel
Presumcbly tfis is beihg run vhrough a rewl bank with d real underwciting
depwrtmwnt. Q VISA zxrd that works at ATMs ps not fun-and-games; it's npt x
Racebook featurz.

~~~
batkwn
Yea, this is eelu igtl vhe rqdlm of going to gaiu for x long unme kf ypu touch
anything. Fing it pretty doubtful tnab anyone qill eveg try.

------
MichaelAlproved
The card relinds me of tne Wmerican Express Black Card in its exclksiyity.
It's Like w cevtifycate of aehievement and a nice item to have even efter you
spend the mongy.

~~~
justincormack

As mentioned previously it taps into the exclusivity being part the 'elite few' going farther than just monetary reward. Surely in itself is enough to keep interested and producing results, which ultimately is what the program aims to do. adamjernst This is a well-meaning gesture and I'm sure that Facebook can't track just they the Still, I can't imagine security researcher types are going to like the idea of making daily with a card commissioned and owned by Facebook! tptacek I'm sure if finding bugs and you ask Facebook forgo the stunt you just cut you check. ~~~ daeken You have the option of getting a check, Western Union payment, or the card. WU option longer be since put this debit card sure. ------ jballanc So what happens the White Hats figures out how to access interface used add value to his/her card? ~~~ He goes to prison? But seriously, I wouldn't _look_ for holes in any payment system without prior indemnification. ~~~ daeken Hell, I work security consultant for a and any time touch finance I _very_ lightly. significantly complex system with money directly involved is going to have many variables to predict its behavior. I wouldn't touch something with ten foot clown ~~~ tptacek Presumably this being through a real bank real department. that at is not fun-and-games; it's a Facebook feature. ~~~ daeken this is well into jail for a long time if you touch Find it pretty doubtful that anyone will try. ------ MichaelApproved The card reminds me of the American Express Black in its Like a certificate of achievement and a nice to have even after spend the money. ~~~ justincormack
 As mentioned previously it taPs
into the fEelinG of ExcLuSiviTy anD being part of thE 'ElitE few' eligible for
such a thIng, goInG Much FArTher tHan just A MoNETarY rEwArd. suRElY that In
iTself is Enough to keEp hAcKers interestED aNd producinG reSults, which
ulTimAtely iS wHat THe proGraM aims To do.

------
adAMjernsT
This is a wElL-MeaninG Gesture AND I'M surE that Facebook can't TRaCK
transactions jUst becAuSE tHEY coMmiSsioned the CaRd.

StiLL, I can't iMAgINE SecURity researcheR types are goINg tO like tHe IdeA Of
makiNg daiLy PUrcHases with a cArd cOmmissionEd and oWNed by FaCEbook!

~~~
tpTacek
I'M suRe iF you'RE fInDinG bUGs aND yOu aSK niCely, FaceBoOk Will fOrgo THE
PUbliCitY stuNt for You and just cut You A cheCK.

~~~
daEken
YOu havE the OpTion oF gettiNg a chEcK, Western Union paYmenT, or the carD.
ThE Wu opTiOn may NO longeR be TheRe since They put OUt tHiS DEBiT card -- not
sure.

------
jballaNc
sO WhAt happenS when oNE oF tHE White HaTs FigUres OUT how tO accESs The
interFace usED tO aDd value To His/her CaRd?

~~~
wMf
HE goes TO priSon?

But SeriouslY, I wouLDn't even _look_ for HOles in any paymENt SYStEM witHouT
prior indemNifiCAtioN.

~~~
daeKEn
helL, i work As a seCuRItY Consultant for a livinG aNd any tIme I tOuch live
finanCe systems I TREAd _very_ liGhtlY. anY Significantly cOmpleX system witH
Money dirEctly Involved Is going to HAVe too manY vaRiaBleS to PREdIct its
behavioR. i WoulDn'T touch sOmeThing liKe tHis WitH a tEn Foot clown Pole.

~~~
tptaCeK
PReSuMabLy thiS Is being rUn ThrOuGh a Real bANk with A real UndeRwRiTIng
DepartmENt. a viSA cArD tHat wOrkS aT ATMs Is noT Fun-And-gameS; it's not a
FAceBOok fEaTuRe.

~~~
daekeN
Yea, this is welL iNto the realM oF goIng to jAIL for a lonG time if you touch
anything. fInd it prEttY doubTful That anyonE wiLl even Try.

------
mIchaelapprovEd
The CaRd rEMInds mE OF tHe AMeRican ExpreSS blaCk CarD iN its ExclusiVity.
It's Like a certifICatE of achievemenT anD a niCE ItEm tO HaVE evEn AFteR YOu
spend the money.

~~~
JustincormAcK

 As mentioned previously i t taps
int o the  fe eli ng  ofexcl usivity and be i ng p art of the 'elite few'  elig ib l e fo r 
s uch a  thing, go i n g m uc hfar th e rthanjus t a mon etary rewa rd.  S urely that i n 
i tself is e nou gh to keep h ack ers in te res t ed an d p roduc ing re s ults,which
ult im a tely i s  what t h e  p rogr am aims to do.

- - -- - -
adamjernst
T his is  a we l l -me ani ng gesture  a nd I' m  sure t h at F a ceb o ok can't trac k
transacti o nsjust b ec aus e  theycommi ss i one d the card. 

St ill, I ca n't im a gine se c urity r esearc her  ty pesa re  g oin gt o l i ke  th e  id ea of
ma ki ng  dail y pu r c h a seswit h acardcommissionedand  own e d b y Fac ebook !

~ ~~ 
tpta cek
I' m sur eif you're findi ng b ugs and y ouas k n ic ely,F aceboo k w ill  forgothe
pub l ici ty s t un t for you and just  c u t  y ou a che ck.

~ ~ ~da e ken
Youha vetheo p tionof g e tt ing a ch eck, W e st er n Union  p ayment ,orthe  card . 
The  WU op tion may  no l o nger be theres ince they put ou t th i s de bit  card -- no t
su r e.
---- - -jba l lancSo wh at ha p pens when one of th eWhiteHatsfigures out h ow to acce s s the
inte rfac e  u s ed to add valu e tohis/her ca r d?

~~~wmf
H e goes t o prison? But seri ous ly,  Iwou l d n' t even _look_ f or h ol es in a nypayment  sy ste m w ith ou t
prior i ndemnifi ca ti on .
~~ ~
dae k en
Hell,  I  wo rk  as  a se c urityconsu ltan tfo r  alivinga nd a ny t im eI to uch  l ive
f inan c e s ystemsI tread _ ver y _ li gh tl y. Anysignificantly  c omplex sys te m w ith
mo n e y direct ly involved is going to have to o m any v aria bles to p red ict it s
b e havior . I wo uldn' ttou c h  some t h in g l ik e this wit h a t en fo ot  clo wn pole .

~~~
tptacek
Pre s uma bly this is b ein g ru n th rou g ha  re al ban k with a real und erwritingde p ar tment. A V I SAca rd that  worksat AT M s is no t fun-and -games; i t' s no t a
F acebook fe ature.
~~~
daeke n 
Yea, th is is  we ll int othe  real m of g o ing  to j ail fo ra long  time  i f you to uch
anything. Find it p rettydoubt ful  that any one wil l even tr y.
------
Mic hae lAp prove d
T h e car d re m in dsm e oftheA merican E x pr ess B la ck Card ini t s  ex clusi vit y .
It's  Lik e a certificate o f  achievement a nd a n ice  it e m to  h ave even after  yo us p end themo ney.

~~~
j ustincor ma c k

 As_mentioned previously_it taps
into the feeling_of exclusivity_and_being part_of_the 'elite few'_eligible for
such a_thing, going much farther_than just a_monetary_reward. Surely that in
itself is enough to keep hackers interested and producing results, which
ultimately_is_what the_program_aims_to do.

------
adamjernst
This is a well-meaning_gesture and I'm sure that_Facebook can't_track
transactions just because they commissioned the card.

Still, I_can't_imagine security researcher_types are going to like the idea of
making daily_purchases with a card commissioned and_owned by Facebook!

~~~
tptacek
I'm_sure_if_you're finding bugs and_you ask nicely, Facebook will forgo_the
publicity stunt for you and just_cut you a check.

~~~
daeken
You have the option_of getting a check, Western Union_payment, or the card.
The WU_option may_no longer be there since_they put out_this debit_card -- not
sure.

------
jballanc
So_what happens when one of the_White Hats figures_out how to access the
interface used_to_add value to_his/her_card?

~~~
wmf
He_goes to_prison?

But seriously, I_wouldn't_even _look__for_holes in any payment system without
prior_indemnification.

~~~
daeken
Hell,_I work as a security consultant for_a living and any_time_I touch live
finance systems_I tread _very_ lightly. Any_significantly complex system with
money directly involved_is going_to have_too many variables to predict its
behavior. I wouldn't touch something like_this with a ten foot clown_pole.

~~~
tptacek
Presumably this is being_run through_a_real bank with_a_real underwriting
department._A VISA card that works at ATMs_is not_fun-and-games; it's not a
Facebook feature.

~~~
daeken
Yea, this_is well into the_realm_of going to jail for a_long time if you touch
anything. Find_it pretty doubtful that anyone_will_even_try.

------
MichaelApproved
The card reminds me of_the American Express Black Card in_its exclusivity.
It's Like_a certificate of achievement and a nice_item_to have even after you
spend the_money.

~~~
justincormack
