4 ms·

Abusing a bug is not really worth it imo, otoh reporting it through a bug bounty seems like borderline scam. $500 for bugs supposedly top engineers missed and y

by a_imho 10y ago

Abusing a bug is not really worth it imo, otoh reporting it through a bug bounty seems like borderline scam. $500 for bugs supposedly top engineers missed and you worked on for days (e.g. communicating with the respective teams can take up considerable time) is a measly return. I get that money might not be the main concern here, but people could really negotiate a fee before disclosing the details. Lowballing this hard is mildly insulting imo.

paulpauper 10y ago
'Negotation' can be interpreted as exortion or blackmail. Bug bounties do not seem worth it unless there is no obvious way to make money or you have more to lose by exploting it than disclosing
- deleted 10y ago
  [deleted]
- Cpoll 10y ago
  Not quite. Blackmail is defined as demanding money in order to not reveal something. As long as there's no threat of selling the exploit to another party, there's nothing illegal about it.
wineisfine 10y ago
On the other hand, it gives the author credibility and it's probably good for finding a good job.
- nommm-nommm 10y ago
  And the write-ups drives lots of traffic to their blog which could be monetized. Additionally they can get speaking engagements from it. Saw a talk on bug bounties a while ago. The people getting the most bounties are on India.