3 ms·

Yeah for purposes of the reward it should only be allowed to be considered a dupe if it duplicates a disclosed bug.

• laurencei 4y ago
  I suppose the risk is people could 'game' the system. Person A finds the issue, reports it. Then Person A secretly tells Person B about it (with no apparent connection), and Person B reports the same issues a few weeks later, but with apparent different code/description to look ever so slightly different.
  • Gasp0de 4y ago
    Split the reward between everyone who reported it. It's even still kind of fair: The more people find it the easier it was to find.
    • bornfreddy 4y ago
      Of course, then when A and B independently find a bug, B can enlist C, D and E, thus taking 80% instead of 50% of the bounty. No system is perfect.
• Someone1234 4y ago
  I agree, but just to play devil's advocate if I discover a bug, disclose it, then tell all my friends to also file a report before it is filed they'd have to honor multiple bounties. I, too, am frustrated that I've read far too many stories about someone reporting a devastating critical exploit and all they get is "this is a dupe" back without further explanation. Makes one paranoid that employees are working with someone externally, back dating their bug reports, and splitting the bounty.
  • tedivm 4y ago
    You'd probably violate the agreement so you and everyone else technically wouldn't qualify and would be committing fraud. That said there are other options, such as splitting the reward for a vulnerability amongst those who report it (even the dupes). This would incentivize people not to disclose the vulnerabilities while keeping the payouts static.