3 ms·

Imho it would be fair if it was treated on a cost per hour basis. So a typical sec researcher will charge $350 per hour. So if this hack took 10 hours then $3

Imho it would be fair if it was treated on a cost per hour basis. So a typical sec researcher will charge $350 per hour. So if this hack took 10 hours then $3500 would be fair

justusthane 6y ago
I’m not a security researcher but I disagree with this rationale on a number of levels. First, just intuitively it feels wrong. It’s like saying that if you need a $20 permit for camping, but if you get caught camping illegally the fine should only be as much as the permit. Clearly it should be more. More specific issues: - Who determines how long the hack took? - A security researcher is guaranteed the $350/hour whether or not they find the exploit. The bug hunter only gets paid if they find an exploit. Thus, if you follow this out logically every bug hunter should really just be a contracted security researcher and the only bugs being uncovered would be the ones companies were paying upfront to find. In other words, freelance bug hunting is deincentivized.