3 ms·
>> And I still think that line of thinking is bullshit. You haven't given any real refutation to the comment linked by the parent. How qualified is your opinio
by dsacco 11y ago
>> And I still think that line of thinking is bullshit.
You haven't given any real refutation to the comment linked by the parent. How qualified is your opinion? You're entitled to it, but know that most bug bounty participants and members of the actual security industry disagree with you.
- arcticfox 11y agoMy refutation is in the linked discussion. And I'm reasoning from economic first principles, not experience in the field. From first principles, I don't understand the argument that $10,000 is fair. At least, I don't understand that argument any more than why $10 is fair - which is my point, that it's arbitrary. And in my arbitrary opinion, $10,000 is grossly low compared to the relative work involved and money at stake. The FBI just paid $1M to access one guy's iPhone. The vulnerability in the linked discussion, which was guaranteed access to any FB account, was a $10,000 bounty. IMO those numbers need to be a lot closer together. Edit: $15,000