4 ms·
> Having a financial incentive to mess up AMD might explain why they only gave 24 hours' warning, though. A good way for companies to prevent this is to have a
by zrm 9y ago
> Having a financial incentive to mess up AMD might explain why they only gave 24 hours' warning, though.
A good way for companies to prevent this is to have a generous bug bounty program. Money is still transferred from the shareholders to the researchers, but then the company can impose conditions like delaying public disclosure for a reasonable time to prepare a fix.
- deong 9y agoIf it's actually someone attempting to make money on a short or to benefit from a working relationship with a competitor, then a bug bounty program does nothing. No one can run a bounty program that pays out anywhere near as much as the information is actually worth to an adversary. Bug bounties work to engender a bit of good will among researchers and to provide some incentive to an otherwise neutral party to play ball. They don't mean shit to a hedge fund or a competitor in a multi-billion dollar industry.
- ISL 9y agoNot unless the bounties are large enough to attract the attention of a hedge fund.
- zrm 9y ago> Not unless the bounties are large enough to attract the attention of a hedge fund. Which they should be if the alternative is a much larger loss to the company's share value. The shareholders come out ahead to pay five million on a bug bounty if the alternative is to lose a billion dollars in market cap.
- throwawayjava 9y agoI'm not a finance expert, but my very lay person understanding of how financial markets work tells me that those would have to be some rather huge bounties. See e.g., the effect on Intel from earlier this year: https://qz.com/1171391/the-intel-intc-meltdown-bug-is-hitting-the-companys-stock-big-time-while-rival-amd-is-soaring/ https://qz.com/1171391/the-intel-intc-meltdown-bug-is-hittin...