3 ms·

So basically google wanted to give this guy nothing. Then he set a hard deadline for disclosure and google managed to buy him for 70k so they could stick with t

by h43z 4y ago

So basically google wanted to give this guy nothing. Then he set a hard deadline for disclosure and google managed to buy him for 70k so they could stick with their own deadline.

advisedwang 4y ago
Or more charitably, by the terms of the program he wasn't eligable for anything, but they gave him seventy thousand dollars out of goodwill and the spirit of the program.
- beeboop 4y ago
  Then they would have done this before the sorta-threat of his own disclosure date.
tempestn 4y ago
I agree that it appears to have been the disclosure threat that resulted in the bounty, but I don't agree (if I'm reading you correctly) that the OP acted unethically. It sounds credible to me that he was just doing everything he could to get the bug fixed.
Sophira 4y ago
According to the article, the reporter had already decided before the bounty had been set that they would wait for the fix: > I also decided (even before the bounty) that I am too scared to actually put out the live bug and since the fix was less than a month away, it was not really worth it anyway.
- yreg 4y ago
  According to the bug thread transcript Google have not yet known he's not going to disclose in October when they offered the 70k. https://feed.bugs.xdavidhu.me/bugs/0016 https://feed.bugs.xdavidhu.me/bugs/0016
hadlock 4y ago
It would not surprise me if in some cases, google runs the exploit up the tree to the NSA to see if they're actively using this for matters of national security, then slow-walk the patch to release. Given how easy the exploit is (no software needed, no special equipment beyond a paper-clip), would not surprise me if this has been in wide use for several years now by various groups.
- saagarjha 4y ago
  Or maybe not? https://www.technologyreview.com/2021/03/26/1021318/google-security-shut-down-counter-terrorist-us-ally/ https://www.technologyreview.com/2021/03/26/1021318/google-s...

by h43z 4y ago

So basically google wanted to give this guy nothing. Then he set a hard deadline for disclosure and google managed to buy him for 70k so they could stick with their own deadline.

advisedwang 4y ago

Or more charitably, by the terms of the program he wasn't eligable for anything, but they gave him seventy thousand dollars out of goodwill and the spirit of the program.

beeboop 4y ago
Then they would have done this before the sorta-threat of his own disclosure date.

tempestn 4y ago

I agree that it appears to have been the disclosure threat that resulted in the bounty, but I don't agree (if I'm reading you correctly) that the OP acted unethically. It sounds credible to me that he was just doing everything he could to get the bug fixed.

Sophira 4y ago

According to the article, the reporter had already decided before the bounty had been set that they would wait for the fix: > I also decided (even before the bounty) that I am too scared to actually put out the live bug and since the fix was less than a month away, it was not really worth it anyway.

yreg 4y ago
According to the bug thread transcript Google have not yet known he's not going to disclose in October when they offered the 70k. https://feed.bugs.xdavidhu.me/bugs/0016 https://feed.bugs.xdavidhu.me/bugs/0016

hadlock 4y ago

It would not surprise me if in some cases, google runs the exploit up the tree to the NSA to see if they're actively using this for matters of national security, then slow-walk the patch to release. Given how easy the exploit is (no software needed, no special equipment beyond a paper-clip), would not surprise me if this has been in wide use for several years now by various groups.

saagarjha 4y ago
Or maybe not? https://www.technologyreview.com/2021/03/26/1021318/google-security-shut-down-counter-terrorist-us-ally/ https://www.technologyreview.com/2021/03/26/1021318/google-s...