4 ms·
But if the bounties are 20x as high then surely it will draw more whitehats to the market. A security engineer who is working at Netflix or Visa making over $20
by ponker 6y ago
But if the bounties are 20x as high then surely it will draw more whitehats to the market. A security engineer who is working at Netflix or Visa making over $200k or whatever will not work late nights for a $10k bounty but he might for a $500k bounty.
- paxys 6y agoCompanies like Google and Facebook have paid up to $50K for single bug reports. Ultimately the problem is that regardless of the effort you put in your earnings are likely going to be $0, due to the sheer amount of randomization and luck involved, which makes it unlikely that anyone will leave their full time job for it.
- ponker 6y agoI don’t think anyone will quit their job for it but it will influence the decision of “play flight simulator or hack on targets”
- simonh 6y agoIn theory yes, but there’s going to be serious diminishing returns. At what point does doubling the reward no longer double the number of person hours you’re incentivising to work on the problem? At what point does doubling it increase the effort expended by less than 10%? Compared to spending that money on your own research teams, where the Cost/effort your buying is likely to be much closer to linear.
- ponker 6y agoOn the contrary, for low-probability payouts like lotteries, doubling the reward more than doubles the number of people who play. Almost nobody would play a lottery that gives you a 1 in 50 chance of winning $5, but plenty of people play lotteries for a 1 in a billion chance of $100 million.