Thus my point: until bug bounties are calculated to approach or exceed the black or grey-market value of exploits, they can't strongly push people towards ethic

Thus my point: until bug bounties are calculated to approach or exceed the black or grey-market value of exploits, they can't strongly push people towards ethical behavior. Right now bug bounties seem mainly to serve as a way for skiddies in the third world with burp to make for-them-bank on trivial XSS vulns and for serious professionals to make a little extra money. And, y'know, to serve the PR purpose of being able to say you have a bug bounty program.