5 ms·
I still consider these fees way too low. I understand there are not too many legal buyers for Windows bugs, but wonder whether it is more profitable from a fina
by a_imho 9y ago
I still consider these fees way too low. I understand there are not too many legal buyers for Windows bugs, but wonder whether it is more profitable from a financial pov to just disclose bugs as an upfront investment and wait for a PR disaster to have some actual leverage to negotiate fair prices.
- romanovcode 9y agoIf the PR disaster already happened why would they pay you? Makes no sense.
- a_imho 9y agoSorry, I mean the next time around, e.g if you are sitting on a couple of exploits. 250k is like the salary of a random manager, for me it really puts into perspective the strong commitment to security when they offer 15k (a monthly paycheck) for a rce in Edge potentially affecting millions of computers. Nevermind the fact finders are at the mercy of MS who can award whatever they want or simply claim it was found internally.