8 ms·
I see this as an example where the system works. Valve has an incentive to pay for bugs. The researcher than has an incentive to disclose them privately. If Val
by c3534l 7y ago
I see this as an example where the system works. Valve has an incentive to pay for bugs. The researcher than has an incentive to disclose them privately. If Valve doesn't pay fairly, the bug is disclosed, Valve pays the price and is forced to fix it, and be running a scam of a bug bounty program, they've exposed themselves to more disclosures. Valve now has an incentive to fix their program either by working with this bug hunter or increasing payouts so other hunters beat him to the point. This is how the system should work. Decentralized self-regulation needs people like Valve to fuck up once in a while so that the forces at play sufficiently punish them until they improve their process.
- jupp0r 7y agoThe meta-process might work, Valve's process is still broken.
- jay_kyburz 7y agoEverybody makes mistakes, lets see if they can learn from theirs. I haven't heard that they keep making this same mistake (but I could be wrong.)
- jupp0r 7y agoThis happened end of June, they should have had ample time to reach out to @viss, make amends and change their process.
- jay_kyburz 7y agofollow up https://www.gamasutra.com/view/news/349352/Valve_tweaks_bug_bounty_program_after_mistakenly_turning_away_researchers.php https://www.gamasutra.com/view/news/349352/Valve_tweaks_bug_...