5 ms·
Being stingy with big bounty money seems so shortsighted - if you are going to have a B.B. program and encourage people to suss out exploits, why would you then
by chakalakasp 9y ago
Being stingy with big bounty money seems so shortsighted - if you are going to have a B.B. program and encourage people to suss out exploits, why would you then want to piss those people off? It’s not like there isn’t a completely separate market out there for the same exploits run by people you’d collectively refer to as “the enemy”.
- sandworm101 9y agoThe problem with such negotiation is that at the moment someone even describes the bug they have found, they eliminate the possibility of selling to anything other than the BB program. If you describe your bug to them, but then the BB negotiations go south and you walk away, you are a suspect in any future exploit of that bug. So the BB program knows that they have the researcher on the hook from the moment he makes contact.
- supergreg 9y agoWhat about publicly announcing it so anyone can make the exploit?
- dingo_bat 9y agoOr announce it publicly and then hack them yourself.
- pc86 9y agoAlso known as "commit multiple felonies."
- gatmne 9y agoI'd call it plausible deniability.
- pavel_lishin 9y agoI'd also delete that comment, as it might harm any future legal defense.