5 ms·

> there is essentially zero upside to screwing over bounty hunters. Well, I felt pretty screwed over after Google decided not to reward me for discovering CVE-

> there is essentially zero upside to screwing over bounty hunters. Well, I felt pretty screwed over after Google decided not to reward me for discovering CVE-2021-30560.

tptacek 5y ago
I'm not saying you shouldn't feel that way. I'm saying Google has no incentive to actually screw you over; that they have in fact the exact opposite incentive.
- mtnGoat 5y ago
  Aside from the monetary gain of simply not paying. You keep posting this but it’s simply not true, there is always a gain in not paying debts. Money is money, The making of which is Google’s cute business. Chill on the loop-aid consumption.
- nwellnhof 5y ago
  I understand your point, but saying that Google has no incentive isn't accurate. There's always an incentive not to pay for bug reports, simply because it results in a short-term gain. Whether it's a good decision in the long run is another question. It's more helpful to analyze the situation from a game-theoretic standpoint. Bug bounty programs are a typical example of a cooperative game. If someone reports a security issue, they start the game by cooperating. Google can then choose to cooperate by paying a bounty or they can defect by refusing a reward. Like in the classical prisoner's dilemma, both parties can typically maximize their rewards by choosing to cooperate. My case is a bit special. While I don't know the exact reasons why Google chose not to reward me, it's possible that they thought I would continue to cooperate even after they defected. But like most rational players, I chose to stop cooperating, which ultimately leads to the worst possible outcome.
  - FreshFries 5y ago
    Being the one who decides to pay or not pay bounties in our bug bounty program: trust me when I say that the internal discussion, fact finding, classification, quality control, release planning & the rest exceeds your bounty by a factor 10. Same goes for the dialogs with unhappy hunters who like 'proof' for the arguments that a bug / vulnerability is not there. There is literally no financial incentive for me at all to not reward, au contraire actually.
ipaddr 5y ago
Why would they care. They have gotten your best work for free and can safely cast you aside because another sucker will take your place.
- rossjudson 5y ago
  It sounds like you have a story to tell.
  - ipaddr 5y ago
    I've never taken part. I have seen so many people find a bug and not getting paid for a variety of reasons and even the ones who do get paid get paid so little compared to the value it gives the company. I'm sick of the everyday tech person getting taken advantage of and used as a cheap workforce. These bug bounties should pay people for the time they invest.

> there is essentially zero upside to screwing over bounty hunters. Well, I felt pretty screwed over after Google decided not to reward me for discovering CVE-2021-30560.

tptacek 5y ago

I'm not saying you shouldn't feel that way. I'm saying Google has no incentive to actually screw you over; that they have in fact the exact opposite incentive.

mtnGoat 5y ago
Aside from the monetary gain of simply not paying. You keep posting this but it’s simply not true, there is always a gain in not paying debts. Money is money, The making of which is Google’s cute business. Chill on the loop-aid consumption.
nwellnhof 5y ago
I understand your point, but saying that Google has no incentive isn't accurate. There's always an incentive not to pay for bug reports, simply because it results in a short-term gain. Whether it's a good decision in the long run is another question. It's more helpful to analyze the situation from a game-theoretic standpoint. Bug bounty programs are a typical example of a cooperative game. If someone reports a security issue, they start the game by cooperating. Google can then choose to cooperate by paying a bounty or they can defect by refusing a reward. Like in the classical prisoner's dilemma, both parties can typically maximize their rewards by choosing to cooperate. My case is a bit special. While I don't know the exact reasons why Google chose not to reward me, it's possible that they thought I would continue to cooperate even after they defected. But like most rational players, I chose to stop cooperating, which ultimately leads to the worst possible outcome.
- FreshFries 5y ago
  Being the one who decides to pay or not pay bounties in our bug bounty program: trust me when I say that the internal discussion, fact finding, classification, quality control, release planning & the rest exceeds your bounty by a factor 10. Same goes for the dialogs with unhappy hunters who like 'proof' for the arguments that a bug / vulnerability is not there. There is literally no financial incentive for me at all to not reward, au contraire actually.

ipaddr 5y ago

Why would they care. They have gotten your best work for free and can safely cast you aside because another sucker will take your place.

rossjudson 5y ago
It sounds like you have a story to tell.
- ipaddr 5y ago
  I've never taken part. I have seen so many people find a bug and not getting paid for a variety of reasons and even the ones who do get paid get paid so little compared to the value it gives the company. I'm sick of the everyday tech person getting taken advantage of and used as a cheap workforce. These bug bounties should pay people for the time they invest.