5 ms·

Mid-range engineer at big tech makes $350k / year. I think having a vulnerability like this go to Microsoft instead of criminals is easily worth a few engineer-

Mid-range engineer at big tech makes $350k / year. I think having a vulnerability like this go to Microsoft instead of criminals is easily worth a few engineer-years. A $1M payout is just not unreasonable or even difficult for a $2.5T corporation.

jcims 5y ago
My point isn't that $40K is enough or $1M is too much, it's that pinning public payouts to the grey/black market is unsustainable. This bug could easily be worth $10M in the right hands, so why stop at 7 figures?
- throwaway739 5y ago
  You think Microsoft can't pay $10 million? Paying $40k means they don't give a shit about their customers.
  - pojzon 5y ago
    The reason you pay so little is to not encourage ppl to even start looking. Knowledge required to find stuff like that is very scarse. And you have to know where to look for. Chances to find something really big are so small that its not worth it to look for them finnancially. Thats why ppl don’t do that often. They do it if they have long cooperation history with given company because they are treated as an employee. TL;DR is that you don’t want to encourage ppl to start looking. All software has bugs, so its only a matter of time until someone finds something.
  - jcims 5y ago
    Would you pay 100x as much for a service that is protected by that level of award?
  - EVa5I7bHFq9mnYK 5y ago
    1. Work at Microsoft. Make a bug. 2. Tell your "security researcher" buddy. 3. Split $10m in zcash.
    - syrgian 5y ago
      Since you are already being a criminal, you could go all the way and sell it to a security agency, Zerodium or another criminal. The company you work for, once they track the code back to you, will investigate you to make sure you did not make profit on it.
      - ta988 5y ago
        Thats why many doing that kind of stuff probably use a third party that keep money for a definite amount of time.
- woofie11 5y ago
  Well, my experience is that grey/black markets and crime pop up virtually everywhere where people can't afford to make an honest living which covers food and housing. Once you reach a certain bar, people do the right thing. $40k isn't enough to cover the cost of research+reporting at livable salaries, let along overhead, fake starts, etc. 1) Microsoft could afford $10M 2) I think people would be honest well short of $10M 3) The cost to customers, if this went public, would be far more than $10M. You want people to be able to make an honest living on security research, or otherwise, the only people looking for vulnerabilities, aside from the independently wealthy hobbyists, will be crooks.

jcims 5y ago

My point isn't that $40K is enough or $1M is too much, it's that pinning public payouts to the grey/black market is unsustainable. This bug could easily be worth $10M in the right hands, so why stop at 7 figures?

throwaway739 5y ago
You think Microsoft can't pay $10 million? Paying $40k means they don't give a shit about their customers.
- pojzon 5y ago
  The reason you pay so little is to not encourage ppl to even start looking. Knowledge required to find stuff like that is very scarse. And you have to know where to look for. Chances to find something really big are so small that its not worth it to look for them finnancially. Thats why ppl don’t do that often. They do it if they have long cooperation history with given company because they are treated as an employee. TL;DR is that you don’t want to encourage ppl to start looking. All software has bugs, so its only a matter of time until someone finds something.
- jcims 5y ago
  Would you pay 100x as much for a service that is protected by that level of award?
- EVa5I7bHFq9mnYK 5y ago
  1. Work at Microsoft. Make a bug. 2. Tell your "security researcher" buddy. 3. Split $10m in zcash.
  - syrgian 5y ago
    Since you are already being a criminal, you could go all the way and sell it to a security agency, Zerodium or another criminal. The company you work for, once they track the code back to you, will investigate you to make sure you did not make profit on it.
    - ta988 5y ago
      Thats why many doing that kind of stuff probably use a third party that keep money for a definite amount of time.
woofie11 5y ago
Well, my experience is that grey/black markets and crime pop up virtually everywhere where people can't afford to make an honest living which covers food and housing. Once you reach a certain bar, people do the right thing. $40k isn't enough to cover the cost of research+reporting at livable salaries, let along overhead, fake starts, etc. 1) Microsoft could afford $10M 2) I think people would be honest well short of $10M 3) The cost to customers, if this went public, would be far more than $10M. You want people to be able to make an honest living on security research, or otherwise, the only people looking for vulnerabilities, aside from the independently wealthy hobbyists, will be crooks.