4 ms·

Funny thing is Google does actually pay for reported security bugs. Up to $3133.70: http://dev.chromium.org/Home/chromium-security/vulnerability-rewards-program

• masklinn 15y ago
  I'm pretty sure VUPEN asks for an order of magnitude or two more. Hell, they don't even provide prices on their website, you can request quotes.
  • VMG 15y ago
    I wonder if this kind of thing will set a precedent. If a security firm can "extort" google, what stops a lone hacker to put up a video of a chrome exploit on youtube and demand some arbitrary amount of money as compensation? According to Wikipedia it is technically not extortion because the obtained information that is of value to google is not obtained "unlawfully" and doesn't seem to fall under the category "money, property or services". There seem to be some similarities though.
    • masklinn 15y ago
      > I wonder if this kind of thing will set a precedent. Erm... it's a traditional business model of security firms on the internets... > If a security firm can "extort" google, what stops a lone hacker to put up a video of a chrome exploit on youtube and demand some arbitrary amount of money as compensation? They're not extorting anything. They're not menacing google or anything like that, they have not obtained this information illegally, they've done security research and are releasing their findings to their clients because that's how they make their money. That's it.