4 ms·
Bounties on security vulns have difficult dynamics on incentives though. At these levels you start running the risk of an insider subtly introducing a vulnerab
by jobigoud 7y ago
Bounties on security vulns have difficult dynamics on incentives though. At these levels you start running the risk of an insider subtly introducing a vulnerability and share it with a secret aquaintance.
- devin 7y agoI’ll say it once more. This isn’t that big of a bounty when you consider what Apple’s iPhone security crew make on average/year.
- bsaul 7y agoDon't know why you got downvoted. I think that's a pretty good argument against the particular scenario OP mentionned. Why would an apple employee take the risk to loose his 300k+ / year salary for a 1M bounty (he'll have to share with the acquaintance) ?
- akersten 7y agoI would hope there is sufficient discouragement for that sort of behavior - that's definitely breaking at least two federal laws. Maybe I'm naive, but I would think that any programmer skilled and privileged enough to be able to insert a vulnerability into a mainline product, get it past code review, and make it look like an innocent mistake during the inevitable root-cause analysis would not only know better, but would also value their career enough that whatever payout they got from the bounty wouldn't be worth jeopardizing all they've worked for. And anyway, how's that conversation supposed to play out? "Sorry about that bug boss, yeah could've happened to anyone. Anyway, about my retirement in two weeks..."
- jobigoud 7y agoAnother scenario is, having access to the code, being in a much better position to test and find vulnerabilities in the first place. Instead of disclosing them internally which may just be expected and get you little extra, leak them to a trusted external partner for a share of the bounty.