It's not. OSS projects aren't people with curable diseases. Most of them are labors of love, run by people in their spare time. Those people have needs that ar

It's not. OSS projects aren't people with curable diseases. Most of them are labors of love, run by people in their spare time. Those people have needs that are mostly not met by working on open source projects. Epsilon open source projects are well-enough funded that nobody in the project feels starved for resources. Bug bounty programs are only useful for these projects if the details of the bug are shared with the project. Zerodium's model relies on keeping developers unaware of the bugs for as long as possible [1]. Nobody developing OSS is grateful for programs like Zerodium. [1]: https://security.stackexchange.com/questions/199480/what-does-zerodium-do-with-their-bought-exploits-and-bugs https://security.stackexchange.com/questions/199480/what-doe...