3 ms·
I don't know much about this which is why I asked. It seems that severity-based payouts have created incentives that do not match the program rules? Maybe all
by encoderer 11y ago
I don't know much about this which is why I asked.
It seems that severity-based payouts have created incentives that do not match the program rules? Maybe all rce bugs should be paid out on an assumption that if used they'll lead to access to a shell or to user data.
- tptacek 11y agoSeverity on a vulnerability assessment is based on the bug itself; it's the severity of the RCE.
- bigiain 11y agoYeah - but it's 100% clear from this that FB wanted to brush the RCE under the carpet with a "not at all severe $2500" classification - without ever admitting to losing their private ssl keys or auth token seeds. He clearly _did_ have a "security vulnerability" that gave him the keys to the kingdom. He knew it, and Facebook know it - and they wanted to pretend it was no big deal. Any bets on how many months till there's a large-scale breach of Facebook user data? The reality of the balance between responsible disclosure and selling an exploit is much easier to evaluate now.
- tptacek 11y agoThat certainly is the fun and exciting way to read this story.