4 ms·
> If a researcher reports a qualifying vulnerability already found internally by Microsoft, a payment will be made to the first finder at a maximum of 10% of th
by strictnein 9y ago
> If a researcher reports a qualifying vulnerability already found internally by Microsoft, a payment will be made to the first finder at a maximum of 10% of the highest amount they could’ve received (example: $1,500 for a RCE in Edge, $25,000 for RCE in Hyper-V)
Wow. I guess this kind of functions as hush money? To make sure they don't reveal the issue before MS patches it. But still, this seems like a good move.
- crazcarl 9y agoI wonder how often it happens that a company lies (or stretches the truth) about already knowing about a vulnerability to avoid paying a bounty. If it happens even sometimes, the 10% might provide additional incentive for researches to target Microsoft. Even if they don't get a full payout, at least they get something.
- 43224gg252 9y agoA company would never lie. Especially Microsoft.
- canadianwriter 9y agoMy sarcasm detector is acting a little wonky - there is no real reason for Microsoft to lie about this, it isn't exactly breaking the bank for them.
- devrandomguy 9y agoMicrosoft is composed of people. The people we worry about here, are the ones who might be incentivised to discover exploits before an outsider. They would have an incentive to back-date their work, or their subordinate's work.
- Analemma_ 9y agoThey're not stupid. If they cared so much more about pinching every last dollar than about security, they wouldn't have launched the bug bounty program at all. BTW, as others have mentioned, this is strictly better than the policy of other bug bounties until now, which is "We already found this, so you get nothing"
- albinofrenchy 9y agoI very much doubt they would lie about it; but if the amount in question was so little that they wouldn't care about it, they would just pay the full price.
- tptacek 9y agoMicrosoft is not lying about vulnerability discovery.
- JoshTriplett 9y agoIt also encourages researchers to do research, by making it less likely they'll do a pile of research only to be told "sorry, we already found this, you get nothing". Right now, pursuing a bounty is a risky proposition; this makes it less risky.
- strictnein 9y agoYeah, good point. "Hush money" may have been a little too harsh.
- crottypeter 9y ago1/10th of what you expected is close to nothing though.