3 ms·
Allow me to broaden this a bit: justanother's law: over time, all user-settable severity levels will tend to drift towards the highest available. When I ran a
by Kalium 7y ago
Allow me to broaden this a bit:
justanother's law: over time, all user-settable severity levels will tend to drift towards the highest available.
When I ran a bug bounty program, I saw this firsthand. I got a lot of reports that were had every scary-looking label the reporter could think of attached. In the vast majority of cases, none of them were justified, and it was some low-priority issue.
- eridius 7y agoAt least in the bug bounty version there's an incentive for submitters to make their bug sound as scary as possible, which is that more severe bugs generally pay out more money. So I guess the lesson is, people will adjust their behavior based on their incentives. If you reward people for exaggerating severity, then people will learn to exaggerate severity.