5 ms·

Microsoft has the best bounty hunter program: go fuck yourself. If you find a way to take over MS accounts, or force email swaps, or even gamertag shanaigans,

Microsoft has the best bounty hunter program: go fuck yourself. If you find a way to take over MS accounts, or force email swaps, or even gamertag shanaigans, there is too much money to be made, there is not even a point for a bug bounty. It's like a $40 reward for returning a purse filled with $250k. I agree with OP: no more free bugs.

jodrellblank 5y ago
Make bug bounties pay $250k and people will have their friend inside add some bugs for the outsider to find, and share the payday. Pay-per-bug-found incentivises plenty of counterproductive things as well, especially if we're talking about people who happily sell to anyone on the black market.
- darkarmani 5y ago
  You can do that today with blackmarket exploits, so why do you think actual bug bounties will cause this problem?
  - jodrellblank 5y ago
    Because then you'll be able to do it without needing any black market connections or transactions, which will make it easier, more of it happens above board, there's less to trace or indicate any problem so it's less discoverable, the payment is from a trusted source. Why would making it easier make it happen less often?
deleted 5y ago
[deleted]
Debug_Overload 5y ago
It's not just Microsoft. What most bug bounties pay isn't even close to the amount you can get from selling it on the black market (assuming you have the right connections). It's why selling exploits to nation states and vendors who work with them is so lucrative.
- anonymousDan 5y ago
  How does the black market price compare to the 'nation state' price?
  - saruken 5y ago
    x = y. Where do you think nation states purchase their tools?
- _wldu 5y ago
  I do agree that bug bounties are too small, but isn't selling bugs on the black market illegal? I would much rather get $40 dollars for a bug and some public acknowledgement (which I could use to get a better paying job) than to sell it for criminal use.
  - msoad 5y ago
    Bitcoin solves this!
  - voakbasda 5y ago
    Or, sell it on the black market, and use that connection to get a better job on the black market. Reputation is just as important for criminals, and crime pays better (until you get caught).
  - pixl97 5y ago
    Assuming you live in a place where you can get a high paying job and/or leave the country to get one. Taking a US centric view on this is a great way to ensure nation states have compromised your security.
    - tw04 5y ago
      So if you take a non-US centric view and assume there's no legal repercussions and the person finding the bug has no moral compass, what exactly would prevent them from sharing the bug with a nation state and you at the same time? Sure they may get slightly less from the nation state because the bug would have a shorter shelf life, but it would still make it into the wild long before every system could be patched. Paying more money isn't going to make someone do the right thing.

jodrellblank 5y ago

Make bug bounties pay $250k and people will have their friend inside add some bugs for the outsider to find, and share the payday. Pay-per-bug-found incentivises plenty of counterproductive things as well, especially if we're talking about people who happily sell to anyone on the black market.

darkarmani 5y ago
You can do that today with blackmarket exploits, so why do you think actual bug bounties will cause this problem?
- jodrellblank 5y ago
  Because then you'll be able to do it without needing any black market connections or transactions, which will make it easier, more of it happens above board, there's less to trace or indicate any problem so it's less discoverable, the payment is from a trusted source. Why would making it easier make it happen less often?

deleted 5y ago

[deleted]

Debug_Overload 5y ago

It's not just Microsoft. What most bug bounties pay isn't even close to the amount you can get from selling it on the black market (assuming you have the right connections). It's why selling exploits to nation states and vendors who work with them is so lucrative.

anonymousDan 5y ago
How does the black market price compare to the 'nation state' price?
- saruken 5y ago
  x = y. Where do you think nation states purchase their tools?
_wldu 5y ago
I do agree that bug bounties are too small, but isn't selling bugs on the black market illegal? I would much rather get $40 dollars for a bug and some public acknowledgement (which I could use to get a better paying job) than to sell it for criminal use.
- msoad 5y ago
  Bitcoin solves this!
- voakbasda 5y ago
  Or, sell it on the black market, and use that connection to get a better job on the black market. Reputation is just as important for criminals, and crime pays better (until you get caught).
- pixl97 5y ago
  Assuming you live in a place where you can get a high paying job and/or leave the country to get one. Taking a US centric view on this is a great way to ensure nation states have compromised your security.
  - tw04 5y ago
    So if you take a non-US centric view and assume there's no legal repercussions and the person finding the bug has no moral compass, what exactly would prevent them from sharing the bug with a nation state and you at the same time? Sure they may get slightly less from the nation state because the bug would have a shorter shelf life, but it would still make it into the wild long before every system could be patched. Paying more money isn't going to make someone do the right thing.