12 ms·

Announcing the Windows Bounty Program

282 points by el_duderino 9y ago

strictnein 9y ago
> If a researcher reports a qualifying vulnerability already found internally by Microsoft, a payment will be made to the first finder at a maximum of 10% of the highest amount they could’ve received (example: $1,500 for a RCE in Edge, $25,000 for RCE in Hyper-V) Wow. I guess this kind of functions as hush money? To make sure they don't reveal the issue before MS patches it. But still, this seems like a good move.
- crazcarl 9y ago
  I wonder how often it happens that a company lies (or stretches the truth) about already knowing about a vulnerability to avoid paying a bounty. If it happens even sometimes, the 10% might provide additional incentive for researches to target Microsoft. Even if they don't get a full payout, at least they get something.
  - 43224gg252 9y ago
    A company would never lie. Especially Microsoft.
    - canadianwriter 9y ago
      My sarcasm detector is acting a little wonky - there is no real reason for Microsoft to lie about this, it isn't exactly breaking the bank for them.
      - devrandomguy 9y ago
        Microsoft is composed of people. The people we worry about here, are the ones who might be incentivised to discover exploits before an outsider. They would have an incentive to back-date their work, or their subordinate's work.
        Analemma_ 9y ago
        They're not stupid. If they cared so much more about pinching every last dollar than about security, they wouldn't have launched the bug bounty program at all. BTW, as others have mentioned, this is strictly better than the policy of other bug bounties until now, which is "We already found this, so you get nothing"
      - albinofrenchy 9y ago
        I very much doubt they would lie about it; but if the amount in question was so little that they wouldn't care about it, they would just pay the full price.
    - tptacek 9y ago
      Microsoft is not lying about vulnerability discovery.
- JoshTriplett 9y ago
  It also encourages researchers to do research, by making it less likely they'll do a pile of research only to be told "sorry, we already found this, you get nothing". Right now, pursuing a bounty is a risky proposition; this makes it less risky.
  - strictnein 9y ago
    Yeah, good point. "Hush money" may have been a little too harsh.
  - crottypeter 9y ago
    1/10th of what you expected is close to nothing though.
monocasa 9y ago
It's good to see the bounties increasing to the range you could get on the open market.
- Analemma_ 9y ago
  Every time you compare a bug bounty payout to the price of vulnerabilities on the open market, tptacek dies a little inside. Please, think about poor Thomas.
  - tptacek 9y ago
    A lot of the high-dollar bugs Microsoft is soliciting here actually do have grey-market value.
- mercurysmessage 9y ago
  Yes, I'm pretty glad this is around. Hopefully it will lead to less NSA exploits.
  - astrodust 9y ago
    The NSA will just have to pay more.
    - Fej 9y ago
      They have an almost unlimited budget, as far as we know.
      - monocasa 9y ago
        Eh, I don't know anyone who when faced with managing billions of dollars has said, "OK, this is enough money".
    - mercurysmessage 9y ago
      Where the people pay increased taxes to help the NSA spy on them easier.
ourmandave 9y ago
That max hyper-v payout of $250,000 reminds me of the TV Trope Just Cut Lex Luthor a Check http://tvtropes.org/pmwiki/pmwiki.php/Main/CutLexLuthorACheck http://tvtropes.org/pmwiki/pmwiki.php/Main/CutLexLuthorAChec...
- legulere 9y ago
  Usually you can get more money for exploits on the black market, than from bug-bounties. Governments from all around the world have a lot of money to spend to buy exploits.
  - SingletonIface 9y ago
    People keep saying that but is it true? There are some problems; 1. The seller would like to keep their identity secret so that they aren't prosecuted or attacked. 2. The buyer would also like to keep their identity secret. 3. The seller wants money. How do they know that the buyer will send them the money if they hand over the exploit before getting paid? Normally you'd report theft to the police but you're not going to go to the police and admit to selling exploits. Also you don't know who the seller is. 4. The seller wants the exploit. If they pay first then how do they know they will get the exploit. If you contact some agency directly then surely they will not want to pay you out of fear that you will inform either the public or another government or agency about the transaction? If there was a darknet marketplace for exploits (maybe there already is, maybe there already are several ones?) then that might solve it. There you can have both some degree of anonymity, you can have reputations for sellers and buyers and the DNM can offer escrow of funds.
oxide 9y ago
Its about time. I hope the incentives stay strong enough, and dont require hoops to jump through. otherwise the gray/blackmarkets could out-bid the bounty and cut the red tape to incentivise their own acquisition of the exploits in question.
- tptacek 9y ago
  Microsoft has been doing this for a long time; they're one of the pioneers of bounty programs.
  - ygjb 9y ago
    Much respect to Microsoft and their new found love of bounty programs, but pioneer is a bit of a stretch - they launched their first bounty program in 2013, well after third party bug bug buyers like ZDI, and even after BugCrowd and other bug bounty as a service companies launched.
    - tptacek 9y ago
      I feel like Katie Moussouris switched from SDL to bug bounty stuff at MSFT in like 2011, but I may have the dates fuzzed up a little bit. Really the only point I want to make is that this is not Microsoft announcing their first bounty program.
v4n4d1s 9y ago
Dear Microsoft >Any critical or important class remote code execution, elevation of privilege, or design flaws that compromises a customer’s privacy and security will receive a bounty Windows 10 has a major design flaw which compromises your customers privacy and security. You call it Telemetry and it can't be disabled completely(definitely a bug! Nobody would make such a stupid decision, amiright?). Please send me further instructions on how I can claim my 250k. Also: Why is there nothing for Server 2016?
- mercurysmessage 9y ago
  Just like Apple, yet no one complains about them.
  - nilved 9y ago
    Where do you live where you're not hearing complaints about Apple?
    - mercurysmessage 9y ago
      Not Silicon Valley ;p. I never hear anyone complain or hardly anyone even knowing about it.
      - mrkrabo 9y ago
        Because you can disable it. No?
        mercurysmessage 9y ago
        Yes, with some effort: https://github.com/drduh/macOS-Security-and-Privacy-Guide https://github.com/drduh/macOS-Security-and-Privacy-Guide You probably could with the same amount of effort for Windows, but at least Windows makes it more clear that it is happening.
        9y ago
eitland 9y ago
I reported an information leakage from password fields in Windows some moons ago (ctrl arrow would stop between different character classes in modern Windows style password fields.) I don't think this was a big find but I remember I was still somewhat underwhelmed by the response.
crsv 9y ago
With the increasing number and value of these bounty programs, how viable is a career in professional free lance security bug hunting?
- tptacek 9y ago
  It's doable, but if you're good enough to somewhat routinely find bounty-worthy bugs but not spooky good at it, it's not the most lucrative way to put bug-hunting skills to work.
  - cperciva 9y ago
    I've noticed a spike recently in bug bounties going to people who using a combination of fuzzing and code analysis tools. It may be that we're moving to a point where bug-hunters' ability to use sophisticated tools will be what earns them the most money, rather than their ability to eyeball code and see the bugs. Speaking just for myself: A few years ago I was saying "I should really set aside a few months to learn to use fuzzing tools"; now I'm saying "it's easier to just offer bounties and let someone else do the fuzzing for me".
    - dsacco 9y ago
      As those tools become more widely used and more easy to use, you'll be able to lower the mean bug bounty reward payment as well.
    - mindingdata 9y ago
      There was this thing called "Hostile Subdomain Takeover" where a company would point a subdomain to a particular SaaS product (Say Zendesk), sometime later, they would cancel their subscription but not change the A record. Someone could then go and register a new Zendesk account (If the service doesn't require proof of ownership of domain), and say that they want to use the same subdomain. Now they have a Zendesk account with the URL of http://help.somedomain.com http://help.somedomain.com as an example. And they can phish people quite easily. Anyway, the reason I bring it up is because for a while, I saw people spamming the shit out of bug bounties with this stuff. Because it's super simple to do. So I'm not sure what is more lucrative for an average joe, actually learning proper techniques or trying to piggy back on some low hanging fruit that may be easy to automate.
tiffanyh 9y ago
I wonder what impact this will have on open source software (OSS). OSS can't afford to pay people to look for bugs and improve the overall software. But commercial companies can. I wonder if there will exist a date/time in the future where closed-source software, because of these bug bounties, will yield better (less buggy) software vs OSS.
- tptacek 9y ago
  Facebook, Github, and Microsoft already co-sponsor a well-funded open-source "Internet bug bounty".
- darawk 9y ago
  It seems like this might be in part balanced by the fact that it's much easier to find vulnerabilities in open source software, since it's open source.
- harigov 9y ago
  If you think about it, it was always that way. However, a lot of companies that depend upon open source software also invest on it, so it also gets a reasonably good number of eyes trying to fix bugs and add features.
- computerex 9y ago
  I think that is already the case to some extent.
- jklein11 9y ago
  Similar behaviors likely exists in OSS they are just called different things. For example, ACME Co uses open source project XYZ. Acme Co uses resources to make sure that XYZ is secure and bug free. Acme Co is then incentivized to contribute any changes they have found, because they would like to stay in sync with the master branch of XYZ so they can get any updates the community pushes. In the case of OSS, the pool of resources is likely far bigger than with closed source software.
  - efdee 9y ago
AngeloAnolin 9y ago
Overall, I feel this is a good move by Microsoft. Admittedly from their side, they won't (or cannot) cover all security holes from their system. Asking help from external sources and rewarding them appropriately is also good, allowing them to patch their system. In turn, end users will (hopefully) get an OS that is secure. Win for everyone. Way to go MS!
jumpkickhit 9y ago
Bounties for Edge? Isn't it less than 5% in browser market share? I like the fact they're offering a bounty program, I'm just surprised Edge was included I guess.
- ocdtrekkie 9y ago
  Edge is the recommended primary web browser of Windows going forward... so yeah, it kinda makes sense for them to include it.
- wongarsu 9y ago
  Edge is Microsoft's primary browser. One of the selling points of a browser is security. From their perspective it makes total sense to make sure it's secure.
- Kipters 9y ago
  Edge is also behind webviews in UWP apps, also WWAHost [0] apps and Store-delivered PWAs [1] will run in Edge [0]: https://blogs.windows.com/buildingapps/2015/07/06/project-westminster-in-a-nutshell/#m0ES62MW4DrQdB8L.97 https://blogs.windows.com/buildingapps/2015/07/06/project-we... [1]: https://developer.microsoft.com/en-us/windows/projects/events/build/2017/progressive-web-apps-and-the-windows-ecosystem https://developer.microsoft.com/en-us/windows/projects/event...
- romanovcode 9y ago
  If Edge would be a more responsive on tab-switching and would have devtools on par with Chrome I would use it and I guess a lot of others would too. It's going to the right direction.
kazinator 9y ago
> Bounty payouts will range from $500 USD to $250,000 USD I will need some $25K in cash upfront to be convinced to start using Windows 10.
- kazinator 9y ago
  Not complaining, but technical question: how did that get a downvote when it was 3 minutes old? I have a 5 minute delay configured! I saw "0 points"; then refreshed browser; still said "3 minutes ago". Rubbed eyes, checked profile settings: "delay 5" still configured. "delay" is a profile parameter which specifies the number of minutes which elapse from when you initially create a comment to when it becomes published. This gives you a chance to edit or retract your comment before it is subject to public criticism. I've never before seen a voting or reply event occur on a comment prior to the expiry of the delay. (Maybe some clocks are way out of sync between some distributed servers, so 3 minutes old here means 5 minutes old there? Or maybe NTP suddenly stepped a lagging wall clock forward by a couple of minutes?) To the topic: how much $ can I get out of this? ;)
seanhandley 9y ago
Wow. About time.
keithnz 9y ago
I find the wording of this odd? they have had a bounty program for ages? the list of active bounties is here https://technet.microsoft.com/en-us/security/dn425036 https://technet.microsoft.com/en-us/security/dn425036
- unhinged_wanker 9y ago
  It's more of a scope and payout change than a brand new program.
grandalf 9y ago
I've come to feel that a Windows 10 machine is more secure than an OSX machine, all else being equal.
- xlocicicig 9y ago
  That's interesting. Care to elaborate?
  - romanovcode 9y ago
    False sense on security (on MacOS)
  - stinos 9y ago
    IIRC articles have been posted on HN about this but I don't recall what they were exactly. Also not sure how accurate this [1] is and if it reflects actual security/breaches/... per user, but it does give an indication the OP's feeling might be correct, seeing statements like In 2015, according to the NVD, OSX had the most vulnerabilities, followed by Windows 2012 and Ubuntu Linux. And here [2] it's also at the top and Windows 10 is mentioned as well, but it was quite young then. Similar in 2016 [3] [1] https://community.rapid7.com/community/infosec/blog/2016/04/20/using-the-national-vunerability-database-to-reveal-vulnerability-trends-over-time https://community.rapid7.com/community/infosec/blog/2016/04/... [2] https://venturebeat.com/2015/12/31/software-with-the-most-vulnerabilities-in-2015-mac-os-x-ios-and-flash/ https://venturebeat.com/2015/12/31/software-with-the-most-vu... [3] https://www.cybrnow.com/10-most-vulnerable-os-of-2016/ https://www.cybrnow.com/10-most-vulnerable-os-of-2016/
a_imho 9y ago
I still consider these fees way too low. I understand there are not too many legal buyers for Windows bugs, but wonder whether it is more profitable from a financial pov to just disclose bugs as an upfront investment and wait for a PR disaster to have some actual leverage to negotiate fair prices.
- romanovcode 9y ago
  If the PR disaster already happened why would they pay you? Makes no sense.
  - a_imho 9y ago
    Sorry, I mean the next time around, e.g if you are sitting on a couple of exploits. 250k is like the salary of a random manager, for me it really puts into perspective the strong commitment to security when they offer 15k (a monthly paycheck) for a rce in Edge potentially affecting millions of computers. Nevermind the fact finders are at the mercy of MS who can award whatever they want or simply claim it was found internally.
xmodem 9y ago
Nice. now can we please have a way of reporting phishing/malware hosted on Microsoft services (Onedrive, hosted Sharepoint, Azure, etc)? I have reported a few of these to Microsoft's CERT team and they just seem to get ignored.
Principe 9y ago
Damn. $250k for a RCE bug in Hyper-V. If that's on the legit market, I can't even imagine what it would sell for elsewhere.

282 points by el_duderino 9y ago

> If a researcher reports a qualifying vulnerability already found internally by Microsoft, a payment will be made to the first finder at a maximum of 10% of the highest amount they could’ve received (example: $1,500 for a RCE in Edge, $25,000 for RCE in Hyper-V) Wow. I guess this kind of functions as hush money? To make sure they don't reveal the issue before MS patches it. But still, this seems like a good move.

crazcarl 9y ago
I wonder how often it happens that a company lies (or stretches the truth) about already knowing about a vulnerability to avoid paying a bounty. If it happens even sometimes, the 10% might provide additional incentive for researches to target Microsoft. Even if they don't get a full payout, at least they get something.
- 43224gg252 9y ago
  A company would never lie. Especially Microsoft.
  - canadianwriter 9y ago
    My sarcasm detector is acting a little wonky - there is no real reason for Microsoft to lie about this, it isn't exactly breaking the bank for them.
    - devrandomguy 9y ago
      Microsoft is composed of people. The people we worry about here, are the ones who might be incentivised to discover exploits before an outsider. They would have an incentive to back-date their work, or their subordinate's work.
      - Analemma_ 9y ago
        They're not stupid. If they cared so much more about pinching every last dollar than about security, they wouldn't have launched the bug bounty program at all. BTW, as others have mentioned, this is strictly better than the policy of other bug bounties until now, which is "We already found this, so you get nothing"
    - albinofrenchy 9y ago
      I very much doubt they would lie about it; but if the amount in question was so little that they wouldn't care about it, they would just pay the full price.
  - tptacek 9y ago
    Microsoft is not lying about vulnerability discovery.
JoshTriplett 9y ago
It also encourages researchers to do research, by making it less likely they'll do a pile of research only to be told "sorry, we already found this, you get nothing". Right now, pursuing a bounty is a risky proposition; this makes it less risky.
- strictnein 9y ago
  Yeah, good point. "Hush money" may have been a little too harsh.
- crottypeter 9y ago
  1/10th of what you expected is close to nothing though.

monocasa 9y ago

It's good to see the bounties increasing to the range you could get on the open market.

Analemma_ 9y ago
Every time you compare a bug bounty payout to the price of vulnerabilities on the open market, tptacek dies a little inside. Please, think about poor Thomas.
- tptacek 9y ago
  A lot of the high-dollar bugs Microsoft is soliciting here actually do have grey-market value.
mercurysmessage 9y ago
Yes, I'm pretty glad this is around. Hopefully it will lead to less NSA exploits.
- astrodust 9y ago
  The NSA will just have to pay more.
  - Fej 9y ago
    They have an almost unlimited budget, as far as we know.
    - monocasa 9y ago
      Eh, I don't know anyone who when faced with managing billions of dollars has said, "OK, this is enough money".
  - mercurysmessage 9y ago
    Where the people pay increased taxes to help the NSA spy on them easier.

ourmandave 9y ago

That max hyper-v payout of $250,000 reminds me of the TV Trope Just Cut Lex Luthor a Check http://tvtropes.org/pmwiki/pmwiki.php/Main/CutLexLuthorACheck http://tvtropes.org/pmwiki/pmwiki.php/Main/CutLexLuthorAChec...

legulere 9y ago
Usually you can get more money for exploits on the black market, than from bug-bounties. Governments from all around the world have a lot of money to spend to buy exploits.
- SingletonIface 9y ago
  People keep saying that but is it true? There are some problems; 1. The seller would like to keep their identity secret so that they aren't prosecuted or attacked. 2. The buyer would also like to keep their identity secret. 3. The seller wants money. How do they know that the buyer will send them the money if they hand over the exploit before getting paid? Normally you'd report theft to the police but you're not going to go to the police and admit to selling exploits. Also you don't know who the seller is. 4. The seller wants the exploit. If they pay first then how do they know they will get the exploit. If you contact some agency directly then surely they will not want to pay you out of fear that you will inform either the public or another government or agency about the transaction? If there was a darknet marketplace for exploits (maybe there already is, maybe there already are several ones?) then that might solve it. There you can have both some degree of anonymity, you can have reputations for sellers and buyers and the DNM can offer escrow of funds.

oxide 9y ago

Its about time. I hope the incentives stay strong enough, and dont require hoops to jump through. otherwise the gray/blackmarkets could out-bid the bounty and cut the red tape to incentivise their own acquisition of the exploits in question.

tptacek 9y ago
Microsoft has been doing this for a long time; they're one of the pioneers of bounty programs.
- ygjb 9y ago
  Much respect to Microsoft and their new found love of bounty programs, but pioneer is a bit of a stretch - they launched their first bounty program in 2013, well after third party bug bug buyers like ZDI, and even after BugCrowd and other bug bounty as a service companies launched.
  - tptacek 9y ago
    I feel like Katie Moussouris switched from SDL to bug bounty stuff at MSFT in like 2011, but I may have the dates fuzzed up a little bit. Really the only point I want to make is that this is not Microsoft announcing their first bounty program.

v4n4d1s 9y ago

Dear Microsoft >Any critical or important class remote code execution, elevation of privilege, or design flaws that compromises a customer’s privacy and security will receive a bounty Windows 10 has a major design flaw which compromises your customers privacy and security. You call it Telemetry and it can't be disabled completely(definitely a bug! Nobody would make such a stupid decision, amiright?). Please send me further instructions on how I can claim my 250k. Also: Why is there nothing for Server 2016?

mercurysmessage 9y ago
Just like Apple, yet no one complains about them.
- nilved 9y ago
  Where do you live where you're not hearing complaints about Apple?
  - mercurysmessage 9y ago
    Not Silicon Valley ;p. I never hear anyone complain or hardly anyone even knowing about it.
    - mrkrabo 9y ago
      Because you can disable it. No?
      - mercurysmessage 9y ago
        Yes, with some effort: https://github.com/drduh/macOS-Security-and-Privacy-Guide https://github.com/drduh/macOS-Security-and-Privacy-Guide You probably could with the same amount of effort for Windows, but at least Windows makes it more clear that it is happening.
        9y ago

eitland 9y ago

I reported an information leakage from password fields in Windows some moons ago (ctrl arrow would stop between different character classes in modern Windows style password fields.) I don't think this was a big find but I remember I was still somewhat underwhelmed by the response.

crsv 9y ago

With the increasing number and value of these bounty programs, how viable is a career in professional free lance security bug hunting?

tptacek 9y ago
It's doable, but if you're good enough to somewhat routinely find bounty-worthy bugs but not spooky good at it, it's not the most lucrative way to put bug-hunting skills to work.
- cperciva 9y ago
  I've noticed a spike recently in bug bounties going to people who using a combination of fuzzing and code analysis tools. It may be that we're moving to a point where bug-hunters' ability to use sophisticated tools will be what earns them the most money, rather than their ability to eyeball code and see the bugs. Speaking just for myself: A few years ago I was saying "I should really set aside a few months to learn to use fuzzing tools"; now I'm saying "it's easier to just offer bounties and let someone else do the fuzzing for me".
  - dsacco 9y ago
    As those tools become more widely used and more easy to use, you'll be able to lower the mean bug bounty reward payment as well.
  - mindingdata 9y ago
    There was this thing called "Hostile Subdomain Takeover" where a company would point a subdomain to a particular SaaS product (Say Zendesk), sometime later, they would cancel their subscription but not change the A record. Someone could then go and register a new Zendesk account (If the service doesn't require proof of ownership of domain), and say that they want to use the same subdomain. Now they have a Zendesk account with the URL of http://help.somedomain.com http://help.somedomain.com as an example. And they can phish people quite easily. Anyway, the reason I bring it up is because for a while, I saw people spamming the shit out of bug bounties with this stuff. Because it's super simple to do. So I'm not sure what is more lucrative for an average joe, actually learning proper techniques or trying to piggy back on some low hanging fruit that may be easy to automate.

tiffanyh 9y ago

I wonder what impact this will have on open source software (OSS). OSS can't afford to pay people to look for bugs and improve the overall software. But commercial companies can. I wonder if there will exist a date/time in the future where closed-source software, because of these bug bounties, will yield better (less buggy) software vs OSS.

tptacek 9y ago
Facebook, Github, and Microsoft already co-sponsor a well-funded open-source "Internet bug bounty".
darawk 9y ago
It seems like this might be in part balanced by the fact that it's much easier to find vulnerabilities in open source software, since it's open source.
harigov 9y ago
If you think about it, it was always that way. However, a lot of companies that depend upon open source software also invest on it, so it also gets a reasonably good number of eyes trying to fix bugs and add features.
computerex 9y ago
I think that is already the case to some extent.
jklein11 9y ago
Similar behaviors likely exists in OSS they are just called different things. For example, ACME Co uses open source project XYZ. Acme Co uses resources to make sure that XYZ is secure and bug free. Acme Co is then incentivized to contribute any changes they have found, because they would like to stay in sync with the master branch of XYZ so they can get any updates the community pushes. In the case of OSS, the pool of resources is likely far bigger than with closed source software.
- efdee 9y ago

AngeloAnolin 9y ago

Overall, I feel this is a good move by Microsoft. Admittedly from their side, they won't (or cannot) cover all security holes from their system. Asking help from external sources and rewarding them appropriately is also good, allowing them to patch their system. In turn, end users will (hopefully) get an OS that is secure. Win for everyone. Way to go MS!

jumpkickhit 9y ago

Bounties for Edge? Isn't it less than 5% in browser market share? I like the fact they're offering a bounty program, I'm just surprised Edge was included I guess.

ocdtrekkie 9y ago
Edge is the recommended primary web browser of Windows going forward... so yeah, it kinda makes sense for them to include it.
wongarsu 9y ago
Edge is Microsoft's primary browser. One of the selling points of a browser is security. From their perspective it makes total sense to make sure it's secure.
Kipters 9y ago
Edge is also behind webviews in UWP apps, also WWAHost [0] apps and Store-delivered PWAs [1] will run in Edge [0]: https://blogs.windows.com/buildingapps/2015/07/06/project-westminster-in-a-nutshell/#m0ES62MW4DrQdB8L.97 https://blogs.windows.com/buildingapps/2015/07/06/project-we... [1]: https://developer.microsoft.com/en-us/windows/projects/events/build/2017/progressive-web-apps-and-the-windows-ecosystem https://developer.microsoft.com/en-us/windows/projects/event...
romanovcode 9y ago
If Edge would be a more responsive on tab-switching and would have devtools on par with Chrome I would use it and I guess a lot of others would too. It's going to the right direction.

kazinator 9y ago

> Bounty payouts will range from $500 USD to $250,000 USD I will need some $25K in cash upfront to be convinced to start using Windows 10.

kazinator 9y ago
Not complaining, but technical question: how did that get a downvote when it was 3 minutes old? I have a 5 minute delay configured! I saw "0 points"; then refreshed browser; still said "3 minutes ago". Rubbed eyes, checked profile settings: "delay 5" still configured. "delay" is a profile parameter which specifies the number of minutes which elapse from when you initially create a comment to when it becomes published. This gives you a chance to edit or retract your comment before it is subject to public criticism. I've never before seen a voting or reply event occur on a comment prior to the expiry of the delay. (Maybe some clocks are way out of sync between some distributed servers, so 3 minutes old here means 5 minutes old there? Or maybe NTP suddenly stepped a lagging wall clock forward by a couple of minutes?) To the topic: how much $ can I get out of this? ;)

seanhandley 9y ago

Wow. About time.

keithnz 9y ago

I find the wording of this odd? they have had a bounty program for ages? the list of active bounties is here https://technet.microsoft.com/en-us/security/dn425036 https://technet.microsoft.com/en-us/security/dn425036

unhinged_wanker 9y ago
It's more of a scope and payout change than a brand new program.

grandalf 9y ago

I've come to feel that a Windows 10 machine is more secure than an OSX machine, all else being equal.

xlocicicig 9y ago
That's interesting. Care to elaborate?
- romanovcode 9y ago
  False sense on security (on MacOS)
- stinos 9y ago
  IIRC articles have been posted on HN about this but I don't recall what they were exactly. Also not sure how accurate this [1] is and if it reflects actual security/breaches/... per user, but it does give an indication the OP's feeling might be correct, seeing statements like In 2015, according to the NVD, OSX had the most vulnerabilities, followed by Windows 2012 and Ubuntu Linux. And here [2] it's also at the top and Windows 10 is mentioned as well, but it was quite young then. Similar in 2016 [3] [1] https://community.rapid7.com/community/infosec/blog/2016/04/20/using-the-national-vunerability-database-to-reveal-vulnerability-trends-over-time https://community.rapid7.com/community/infosec/blog/2016/04/... [2] https://venturebeat.com/2015/12/31/software-with-the-most-vulnerabilities-in-2015-mac-os-x-ios-and-flash/ https://venturebeat.com/2015/12/31/software-with-the-most-vu... [3] https://www.cybrnow.com/10-most-vulnerable-os-of-2016/ https://www.cybrnow.com/10-most-vulnerable-os-of-2016/

a_imho 9y ago

I still consider these fees way too low. I understand there are not too many legal buyers for Windows bugs, but wonder whether it is more profitable from a financial pov to just disclose bugs as an upfront investment and wait for a PR disaster to have some actual leverage to negotiate fair prices.

romanovcode 9y ago
If the PR disaster already happened why would they pay you? Makes no sense.
- a_imho 9y ago
  Sorry, I mean the next time around, e.g if you are sitting on a couple of exploits. 250k is like the salary of a random manager, for me it really puts into perspective the strong commitment to security when they offer 15k (a monthly paycheck) for a rce in Edge potentially affecting millions of computers. Nevermind the fact finders are at the mercy of MS who can award whatever they want or simply claim it was found internally.

xmodem 9y ago

Nice. now can we please have a way of reporting phishing/malware hosted on Microsoft services (Onedrive, hosted Sharepoint, Azure, etc)? I have reported a few of these to Microsoft's CERT team and they just seem to get ignored.

Principe 9y ago

Damn. $250k for a RCE bug in Hyper-V. If that's on the legit market, I can't even imagine what it would sell for elsewhere.