4 ms·

>Google should payout on the total impact of the bug that they measure And what is that total impact?

• robocat 7y ago
  As said: only Google has the resources and motivation to measure the potential impact. David already identified a few places the bug might affect: “I found this regex in the Google Cloud Console’s JS, Google Actions Console’s JS, in YouTube Studio, in myaccount.google.com (!) and even in some Google Android Apps. A day later I even found this line in the Google Corp Login Page (login.corp.google.com)”.
  • wglb 7y ago
    >only Google has the resources and motivation to measure the potential impact. And apparently they have judged the impact less than folks who think $6000 is too small.
  • __float 7y ago
    They may have decided, for example, that the majority of cases were not security related. If they were just cosmetic or something...
• maest 7y ago
  One way to estimate it is to ask how much that bug would've sold for on the black market.
  • notRobot 7y ago
    That'd definitely be more than USD 6k.
    • wglb 7y ago
      Who would the buyer be and how much would they pay?