4 ms·
If Facebook could go back in time and choose between: a) Paying out a $1m USD bug bounty, or b) Accepting the reputational hit from a successful exploit I wo
by jlmorton 8y ago
If Facebook could go back in time and choose between:
a) Paying out a $1m USD bug bounty, or
b) Accepting the reputational hit from a successful exploit
I wonder which they would choose with perfect hindsight?
Facebook runs a great bug bounty program, but given Facebook's size, data footprint, and profitability, perhaps it's worth increasing the rewards.
- therein 8y agoPerhaps any vulnerability reported that can lead to the compromise of user data at a scale should be automatically paid out $1M.
- tantalor 8y agoAre you suggesting requiring this by law?
- Buge 8y agoIf facebook offered a single $1m bug bounty, it would have likely gone to some other vulnerability besides this. I would guess facebook gets a fair number of bug bounty reports of equal or greater severity than this one. Also in the past on HN when people argue that the payout of a bug bounty is too low, there have been comments saying web vulnerabilities are pretty much worthless on the black market. https://news.ycombinator.com/item?id=9041017 https://news.ycombinator.com/item?id=9041017 https://news.ycombinator.com/item?id=16001371 https://news.ycombinator.com/item?id=16001371 https://news.ycombinator.com/item?id=12172699 https://news.ycombinator.com/item?id=12172699