3 ms·
Every time someone gets a bug bounty there's someone saying it's not enough and it should have been a bajillion dollars instead. $5000 for a week's work is grea
by jimmaswell 6y ago
Every time someone gets a bug bounty there's someone saying it's not enough and it should have been a bajillion dollars instead. $5000 for a week's work is great and clearly it's working.
Some points to consider are that there's risk involved dealing with the black market, including getting the payout in a way that doesn't trace back to you and legal liability if you're caught, a company has no reason to pay >=$x for an exploit that will cost them $x, and beyond that I suspect a lot of people simply feel better about telling the company about an exploit than selling it to criminals who will use it for extortion and theft.
- JamesSwift 6y agoSo lets say you are able to find one of these every other week. $130k pretax. But you are finding 26 different bugs that (judging on the responses in this comment section) require fairly clever thinking, and you are doing it consistently. I don't think companies owe it to researchers to exclusively supply their income, but I think theres room for improvement on the payout when most of the point is to deter selling on the black/gray market.
- twox2 6y ago$5K for a long tail bug like this ain't bad.