21 ms·
I think that it's a pretty reasonable payout - people running bug bounties are mostly interested in actual security impact and practical exploitability. And the
by cg-enterprise 6y ago
I think that it's a pretty reasonable payout - people running bug bounties are mostly interested in actual security impact and practical exploitability. And the necessity to hit G server thousands of times to extract even a short video reduces that by quite a large proportion; which is definitely not a shot at the researcher, it's a great find, but exploitability is definitely lower than more direct form of IDOR (e.g. input private video ID and get the whole video in response).
By the same logic, blind SQLi will typically be valued 'less' (hence pay out less) than SQLi with output.
- jonnycomputer 6y agoMy concern here is that, from the perspective of those looking for these, the relevant time spent is not only that spent on identifying this bug, but all the times spent looking for bugs where there were none, or where they didn't see them.
- jononor 6y agoMaybe bug bounty researchers should include this in their writeup that they send with the disclosure. Label it "security" testing, some details on what endpoints/methods where checked. Suggest a market value for this work, and say that an invoice with 50% rebate can be made out to cover it, if they wish. Need to word it carefully to avoid it sounding like a threat or demand. Intention would be to highlight the work put in and the value for the company, and make it as easy as possible to compensate that.
- thw0rted 6y agoYou wouldn't have to hit the server "thousands of times", do a binary search across frames to get the interesting (i.e. incriminating) bits, then flesh out detail. Security cameras often capture single-digit frames per second, but that doesn't make the footage less valuable as evidence.