4 ms·
Does anyone know if Project Zero has a policy on submitting issues found to bug bounties? Curious if they get to "double dip"
by arkadiyt 9y ago
Does anyone know if Project Zero has a policy on submitting issues found to bug bounties? Curious if they get to "double dip"
- SheinhardtWigCo 9y agoHow would that be "double dipping"?
- arkadiyt 9y agoBecause they get full time salaries from Google for bug hunting.
- ars 9y agoThat's not really double dipping, that's more of a bonus.
- SteveNuts 9y agoBut it causes an enormous conflict of interest... Hey Bob can you make a bug, I'll report it, and we'll split the pot?
- throwaway613834 9y agoConfused, which company would Bob be working for here? How would he make a bug?
- lowpro 9y agoAlso is there not always a conflict of interest with bug bounties anyway, as a friend of an employee could always 'find a bug' somewhere. I'm not sure I see the how being Project Zero or a normal user makes a difference.
- tptacek 9y agoThat supposed conflict exists with any bounty program no matter who the bounty hunter works for.
- greglindahl 9y agoWhile it's important to design bug bounties carefully: http://dilbert.com/strip/1995-11-13 http://dilbert.com/strip/1995-11-13 This one doesn't appear to be poorly designed.
- ENOTTY 9y agoI believe most of them donate the bug bounty money to some charity.
- jlgaddis 9y agoI recall reading in the past that Tavis (IIRC) was awarded a bounty for something but that he had them donate it to some charity instead. Seems the right path to take, IMO.