5 ms·

"Paying out at a rate competitive with malicious actors makes it a market and would incentivise bounty hunting. It would be a perverse incentive" I don't get t

"Paying out at a rate competitive with malicious actors makes it a market and would incentivise bounty hunting. It would be a perverse incentive" I don't get this. What's wrong with incentevizing bounty hunting? Isn't the whole point of bounties to provide an incentive to the public to find & report bugs? Personally, if I found a bug that had a market, it's going to the highest (legal) bidder. Be it Mossad, Facebook or Mr. Bone Saw's personal security team. Bug hunting is a professional service not a humanitarian one.

CamperBob2 5y ago
Once, a large city had a rat problem. The pests were everywhere, and none of the usual measures seemed to eradicate them. So the mayor posted a bounty on rats. For every dead rat turned in, the city would pay $5. This strategy (although certainly better-intentioned) failed for the same reason your proposal would fail.
- Closi 5y ago
  I’m not sure I get what you mean - I assume you are referencing the fictional tale of the pied piper of hamlet where the pied piper cleared the hamlet of rats by playing a pipe and leading them to a river, but then the mayor refused to pay because he incorrectly claimed the pied piper brought the rats in from another town, so then in retaliation the pied piper kidnapped all the children and they are never seen again? What’s the similarity here? I’m not entirely sure a fairy tale disproves OPs argument, particularly when the circumstances are so different (you can’t bring in bugs from another app, facebook has a history of paying up and the bounty fees are tiny for them).
  - moconnor 5y ago
    Probably suggesting people would start rat farms. Paying large bounties for bugs incentivises developers to introduce bugs for their “friends” to find. To some extent this dynamic must already exist, which is a troubling thought.
    - grenoire 5y ago
      The analogy makes no sense considering there's no way for people to create bugs (unless they're within Facebook, hah) to farm bounties for.
      - mannerheim 5y ago
        That seems to be the implication, but that seems pretty unlikely because of the risk. If the bounty were, say, 100k, is anyone going to risk a 200k salary over letting a friend of theirs get that bounty? And if you try pulling that off more than once, that's just begging to be caught.
    - deleted 5y ago
      [deleted]
    - Closi 5y ago
      > To some extent this dynamic must already exist, which is a troubling thought. I've not seen any evidence for this behaviour existing, even with Microsoft Bug Bounties of up to $250,000, or even heard of developers being tempted to introduce bugs for friends to find them. I assume the bigger risk is developers intentionally introduce bugs for nefarious purposes (i.e. black market sale), rather than to win a bug bounty.

CamperBob2 5y ago

Once, a large city had a rat problem. The pests were everywhere, and none of the usual measures seemed to eradicate them. So the mayor posted a bounty on rats. For every dead rat turned in, the city would pay $5. This strategy (although certainly better-intentioned) failed for the same reason your proposal would fail.

Closi 5y ago
I’m not sure I get what you mean - I assume you are referencing the fictional tale of the pied piper of hamlet where the pied piper cleared the hamlet of rats by playing a pipe and leading them to a river, but then the mayor refused to pay because he incorrectly claimed the pied piper brought the rats in from another town, so then in retaliation the pied piper kidnapped all the children and they are never seen again? What’s the similarity here? I’m not entirely sure a fairy tale disproves OPs argument, particularly when the circumstances are so different (you can’t bring in bugs from another app, facebook has a history of paying up and the bounty fees are tiny for them).
- moconnor 5y ago
  Probably suggesting people would start rat farms. Paying large bounties for bugs incentivises developers to introduce bugs for their “friends” to find. To some extent this dynamic must already exist, which is a troubling thought.
  - grenoire 5y ago
    The analogy makes no sense considering there's no way for people to create bugs (unless they're within Facebook, hah) to farm bounties for.
    - mannerheim 5y ago
      That seems to be the implication, but that seems pretty unlikely because of the risk. If the bounty were, say, 100k, is anyone going to risk a 200k salary over letting a friend of theirs get that bounty? And if you try pulling that off more than once, that's just begging to be caught.
  - deleted 5y ago
    [deleted]
  - Closi 5y ago
    > To some extent this dynamic must already exist, which is a troubling thought. I've not seen any evidence for this behaviour existing, even with Microsoft Bug Bounties of up to $250,000, or even heard of developers being tempted to introduce bugs for friends to find them. I assume the bigger risk is developers intentionally introduce bugs for nefarious purposes (i.e. black market sale), rather than to win a bug bounty.