4 ms·

> August 17 2021 - MSRC awarded $40,000 bounty for the report. I don't know much about the bug bounty industry, is this the typical payout from what it seems t

> August 17 2021 - MSRC awarded $40,000 bounty for the report. I don't know much about the bug bounty industry, is this the typical payout from what it seems to be a pretty severe vulnerability?

vasco 5y ago
Yes, quite large. Next HN will say how many billions they could afford to pay because of all the potential damage. If it's hard to make sense, the security guard at the bank doesn't get paid a % of the money if they stop a robbery and many other examples off payout being way less than potential damage caused.
- junon 5y ago
  That's a bad faith comparison, and I don't really see the relation between the two.
Veserv 5y ago
Yes. A competent researcher deciding to investigate their products can reasonably be expected to find a new, unique vulnerability of this severity given a few weeks to maybe a month of effort. At a standard consulting rate that amounts to a few thousand to low tens of thousands of dollars, so a $40,000 payout is a fair amount for the amount of effort and difficulty to find a bug that totally invalidates the security of a major service by a top, world class cloud provider.
- wrren 5y ago
  Not a great comparison. A researcher does not work for a company, a researcher is basically a mercenary; they'll go where the money is. If a company pays too little relative to its peers, or fails to pay out too often due to fine-print in the T&Cs, researchers will go elsewhere. That's a serious loss for Microsoft given the kinds of vulnerabilities and their impact that a researcher can find if they're focusing on your platform.
  - lukeasrodgers 5y ago
    I believe the last sentence in the parent comment was (top notch) sarcasm.
technion 5y ago
The part that's contraversial about the MS bounties is that they stopped covering the majority of on-premise products. For example, person that reported the two major Microsoft Exchange vulnerability chains received no payout at all. Ref: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-ProxyLogon-Is-Just-The-Tip-Of-The-Iceberg-A-New-Attack-Surface-On-Microsoft-Exchange-Server.pdf https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-ProxyL...
- junon 5y ago
  MS is pretty bad about vulnerability bounties. I reported one about privilege escalation on WSL1 and received no response plus it was patched within the following months. Was a bit aggravated.
  - xbar 5y ago
    Truly horrible, despite tooting their horn about it a very awful lot.

> August 17 2021 - MSRC awarded $40,000 bounty for the report. I don't know much about the bug bounty industry, is this the typical payout from what it seems to be a pretty severe vulnerability?

vasco 5y ago

Yes, quite large. Next HN will say how many billions they could afford to pay because of all the potential damage. If it's hard to make sense, the security guard at the bank doesn't get paid a % of the money if they stop a robbery and many other examples off payout being way less than potential damage caused.

junon 5y ago
That's a bad faith comparison, and I don't really see the relation between the two.

Veserv 5y ago

Yes. A competent researcher deciding to investigate their products can reasonably be expected to find a new, unique vulnerability of this severity given a few weeks to maybe a month of effort. At a standard consulting rate that amounts to a few thousand to low tens of thousands of dollars, so a $40,000 payout is a fair amount for the amount of effort and difficulty to find a bug that totally invalidates the security of a major service by a top, world class cloud provider.

wrren 5y ago
Not a great comparison. A researcher does not work for a company, a researcher is basically a mercenary; they'll go where the money is. If a company pays too little relative to its peers, or fails to pay out too often due to fine-print in the T&Cs, researchers will go elsewhere. That's a serious loss for Microsoft given the kinds of vulnerabilities and their impact that a researcher can find if they're focusing on your platform.
- lukeasrodgers 5y ago
  I believe the last sentence in the parent comment was (top notch) sarcasm.

technion 5y ago

The part that's contraversial about the MS bounties is that they stopped covering the majority of on-premise products. For example, person that reported the two major Microsoft Exchange vulnerability chains received no payout at all. Ref: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-ProxyLogon-Is-Just-The-Tip-Of-The-Iceberg-A-New-Attack-Surface-On-Microsoft-Exchange-Server.pdf https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-ProxyL...

junon 5y ago
MS is pretty bad about vulnerability bounties. I reported one about privilege escalation on WSL1 and received no response plus it was patched within the following months. Was a bit aggravated.
- xbar 5y ago
  Truly horrible, despite tooting their horn about it a very awful lot.