5 ms·

Google should be ashamed of themselves for this meaningless, token “make ourselves feel good” payout. They have straight up exploited the reporter of the exploi

Google should be ashamed of themselves for this meaningless, token “make ourselves feel good” payout. They have straight up exploited the reporter of the exploit. This could have been used to make millions and they took advantage of the reporter’s good faith and benevolent motivations. Google, this is worth at least $1,0000,000 to you guys, and even more, in lost revenue, plus the impact of what gaming your search algorithm would have cost and damage to your reputation. Stop taking advantage of people. Give this man what he deserves!

x0x 9y ago
I'm not suprised at all that Google rewarded this low. This is why they are always be more blackhat SEO then reporters. Because companies are too cheap to realize how valuable this discoveries are. They are getting too greedy. I agree 100% that this should of been at least $1,000,000 if not much more. If this contenues google could be the next Facebook ^_^ Lets use DuckDuckGo instead everyone ;-)
EADGBE 9y ago
His console says 33.2k of ad buys. I'd say it's worth at least that much to them. It's literally their numbers spitting out how much it would have cost! But hey, at least it's Leet.
- esnard 9y ago
  It was a SEMRush screenshot, not related to Google, so it wasn't their numbers.
  - EADGBE 9y ago
    Apologies. Definitely an estimated start.
- d0ntt4z3m3br0 9y ago
  $31337 should have been minimum payout. Think of the software download rankings..
tekkk 9y ago
They are not setting a very good precedent with this that's for sure. Not everyone will be as white hat as this guy and opt for a little more value. Would this have been even an illegal thing to do per se? Could companies have sued him for lost profit? Anyway even 100k would have been nothing to google. You shouldnt try to be cheapskate with this.
anonnel 9y ago
Well I don’t know if it lost (Google) revenue (interested in understanding how if actually so? maybe missing something), but yeah it was definitely worth a lot of money to anyone who knew of it as a 0-day, and would have been lost traffic/revenue for the serps being bumped down. This is a pretty cool exploit.
deleted 9y ago
[deleted]
kerng 9y ago
Good point. Google probably argued its just an Open Redirect, whereas its an elevation (in the site ranks) with immediate impact on site owners. Hope Google makes this right for the finder and hands out an elevation payout (it's possible to bend your own rules, I doubt this kind of finding is in their typical payout matrix)
- TomAnthony 9y ago
  Yeah, I'm not sure how well it fits in their matrix, though they do have a column for: This category includes products such as Google Search But it is probably intended to mean the front end of it, rather than the ranking algorithm.
jordanlev 9y ago
> they took advantage of the reporter’s good faith and benevolent motivations. Someone with truly benevolent motivations does good things because they believe it's the right thing to do -- not because of a monetary reward. I'm not saying they shouldn't pay him more, but I think it's going a bit far to say they're "taking advantage of him". If I find a wallet on the ground and there's $200 cash in it, I'll return it to the owner and leave all the money there. I don't expect a reward and certainly don't feel like I'm being taken advantage of if they don't give me some of that $$.
- deepbreath 9y ago
  Yeah, but you might feel differently if instead of $200 it had $10m cash. And instead of accidentally coming across it on the ground, you spend months of your own time just walking the streets looking for such a wallet to return. And also the owner is one of the richest men in the world.
oakwhiz 9y ago
There is definitely an asymmetry between the entity that posts a bug bounty and the hunter of that bounty. It's the principal-agent problem: The entity that posts the bounty is also the same agent that decides whether to hand out the bounty or not. The bounty in most cases is variable so it's in their best interest to make some attempt to withhold the bounty by arguing for a lower-valued classification or no classification of the bug. Perhaps it would make sense for a third-party "bounty escrow" agency to exist. The escrow agency may be able to provide impartial arbitration of the exploit, and this may have the side effect of coming to a decision faster and promoting a quicker actual bug fix for the end-users.

x0x 9y ago

I'm not suprised at all that Google rewarded this low. This is why they are always be more blackhat SEO then reporters. Because companies are too cheap to realize how valuable this discoveries are. They are getting too greedy. I agree 100% that this should of been at least $1,000,000 if not much more. If this contenues google could be the next Facebook ^_^ Lets use DuckDuckGo instead everyone ;-)

EADGBE 9y ago

His console says 33.2k of ad buys. I'd say it's worth at least that much to them. It's literally their numbers spitting out how much it would have cost! But hey, at least it's Leet.

esnard 9y ago
It was a SEMRush screenshot, not related to Google, so it wasn't their numbers.
- EADGBE 9y ago
  Apologies. Definitely an estimated start.
d0ntt4z3m3br0 9y ago
$31337 should have been minimum payout. Think of the software download rankings..

tekkk 9y ago

They are not setting a very good precedent with this that's for sure. Not everyone will be as white hat as this guy and opt for a little more value. Would this have been even an illegal thing to do per se? Could companies have sued him for lost profit? Anyway even 100k would have been nothing to google. You shouldnt try to be cheapskate with this.

anonnel 9y ago

Well I don’t know if it lost (Google) revenue (interested in understanding how if actually so? maybe missing something), but yeah it was definitely worth a lot of money to anyone who knew of it as a 0-day, and would have been lost traffic/revenue for the serps being bumped down. This is a pretty cool exploit.

deleted 9y ago

[deleted]

kerng 9y ago

Good point. Google probably argued its just an Open Redirect, whereas its an elevation (in the site ranks) with immediate impact on site owners. Hope Google makes this right for the finder and hands out an elevation payout (it's possible to bend your own rules, I doubt this kind of finding is in their typical payout matrix)

TomAnthony 9y ago
Yeah, I'm not sure how well it fits in their matrix, though they do have a column for: This category includes products such as Google Search But it is probably intended to mean the front end of it, rather than the ranking algorithm.

jordanlev 9y ago

> they took advantage of the reporter’s good faith and benevolent motivations. Someone with truly benevolent motivations does good things because they believe it's the right thing to do -- not because of a monetary reward. I'm not saying they shouldn't pay him more, but I think it's going a bit far to say they're "taking advantage of him". If I find a wallet on the ground and there's $200 cash in it, I'll return it to the owner and leave all the money there. I don't expect a reward and certainly don't feel like I'm being taken advantage of if they don't give me some of that $$.

deepbreath 9y ago
Yeah, but you might feel differently if instead of $200 it had $10m cash. And instead of accidentally coming across it on the ground, you spend months of your own time just walking the streets looking for such a wallet to return. And also the owner is one of the richest men in the world.

oakwhiz 9y ago

There is definitely an asymmetry between the entity that posts a bug bounty and the hunter of that bounty. It's the principal-agent problem: The entity that posts the bounty is also the same agent that decides whether to hand out the bounty or not. The bounty in most cases is variable so it's in their best interest to make some attempt to withhold the bounty by arguing for a lower-valued classification or no classification of the bug. Perhaps it would make sense for a third-party "bounty escrow" agency to exist. The escrow agency may be able to provide impartial arbitration of the exploit, and this may have the side effect of coming to a decision faster and promoting a quicker actual bug fix for the end-users.