3 ms·
> But they're bidding for the attention of the kinds of researchers who find URL whitelist validation bugs. No they’re not. Just because this happened to be a
by mygo 7y ago
> But they're bidding for the attention of the kinds of researchers who find URL whitelist validation bugs.
No they’re not. Just because this happened to be a URL whitelist bug doesn’t mean that this is the primary work that the researcher who found the bug does. Did a URL whitelist validation researcher find this, or did someone researching user auth access find this bug? If Google knew exactly who they wanted to find this bug, then Google would have already found it themselves.
- tptacek 7y agoYes, it does. Vulnerability research is a big field and it is specialized. There are different kinds of vulnerability researchers and, as an imperfect but generally useful rule, the ones doing RCE work aren't looking for web bugs. And the people running the Google bounty program are generally well plugged into the vulnerability research community; they are way, way, way, way, way, way more credible than the median HN comment.
- tptacek 7y agoIt also just doesn't make sense as an objection, because it's not like the bounty rates on reliable clientside RCEs in browsers and mobile devices is capped at $6k, and everyone doing this work knows it.