4 ms·

Do you seriously expect them to pay $100k for a decently serious bug in only one of their products? In comparison, Apple paid 100k [0] for a full account takeo

• clarkevans 6y ago
  Perhaps it shouldn't be Google paying for the security reports, but the government... who then would need the statutory authority to fine Google for a very handsome profit?
• sneak 6y ago
  Yes, $100k is not a lot of money for an issue like this. It's also not a lot of money in Google's security budget. Apple's payout seems rather low to me. If I had a vuln like that and knew they were only paying $100k, I would probably seek to monetize it elsewhere. $3k is almost insulting for something like this, given Google's scale. $31,337 might be more appropriate to at least avoid insult.
  • ffpip 6y ago
    > Yes, $100k is not a lot of money for an issue like this. Requiring rare user action and document URL? Sure. Live in your bounty bubble. > If I had a vuln like that and knew they were only paying $100k, I would probably seek to monetize it elsewhere. But you don't. The person exploiting it knows how much it is worth. > $3k is almost insulting for something like this Not for you to decide. He accepted it, meaning it's not insulting.