3 ms·
But what if producing a sledgehammer only cost 50 cents? Then people would sell sledgehammers for a dollar or less.
by ponyfleisch 10y ago
But what if producing a sledgehammer only cost 50 cents? Then people would sell sledgehammers for a dollar or less.
- rl3 10y agoRather than torture this analogy further: Obviously exploit pricing is generally efficient and adheres to free market principles. That said, it's hypothetically possible that an exploit against a large tech company could sell for far more if the circumstances are right, considering the price to damage ratio is so skewed in addition to the unique nature of each exploit. Therefore, large tech companies don't really have much to lose by paying far more than they currently do on bounties. Granted, eliminating what's largely a hypothetical edge case is not the primary benefit to paying higher; incentivizing far more white hat researchers is.