4 ms·

It doesn't seem out of line with the published award scales of Microsoft's bug bounty program[0]. If the researchers weren't ok with that bounty, they shouldn't

by jsnell 4y ago

It doesn't seem out of line with the published award scales of Microsoft's bug bounty program[0]. If the researchers weren't ok with that bounty, they shouldn't (and wouldn't!) have done the research with that motive. [0] https://www.microsoft.com/en-us/msrc/bounty https://www.microsoft.com/en-us/msrc/bounty

flangola7 4y ago
Or they did it out of moral reasons, which is not something every discoverer of vulnerabilities will care about
- jsnell 4y ago
  If their motive wasn't the bounty, and it is just an unexpected bonus, why complain about it being too small?
  - joosters 4y ago
    The researchers didn't complain about the bounty, AFAIK.
    - jsnell 4y ago
      I know. That's the entire point. It is just HN complaining on their behalf, unsolicited.
      - inferiorhuman 4y ago
        So. What. $40,000 is something that a senior SDE could pay out themselves without flinching. A trillion dollar company like MSFT should do better than that for something so severe. Put another way: just because the researchers didn't (publicly) complain doesn't put MSFT in the right here. There are more than a few kernel developers who didn't raise hell about Linus' abusive behavior. Yet even Linus himself realized his behavior had to change.
      - ethanwillis 4y ago
        It's almost as if HN is a site where we discuss things instead of just passively consuming information. In either case only paying $40,000 for disclosing an exploit like this sends a clear message from Microsoft. They don't take their user's security seriously. And it also incentivizes certain outcomes -- They're cheap and less moral actors who are only motivated by the finanical reward won't bother to engage with Microsoft. Use Microsoft products at your own peril.
- Godel_unicode 4y ago
  Wiz.io is a cloud security company which directly competes with Microsoft’s own offerings. They do this type of research as a marketing expense.
Ensorceled 4y ago
> It doesn't seem out of line with the published award scales And yet, it still seems out of line with the scope of the vulnerability. "seems" implies a subjective measurement. > If the researchers weren't ok with that bounty, they shouldn't (and wouldn't!) Researchers are going to research. Please don't carry water for trillion dollar companies; the reward was paltry don't blame the researchers for Microsoft's cheapness.
- jsnell 4y ago
  I'm not blaming the researchers for anything. They did the research, found a major issue, and got a reward in line with the published expectations, and have not complained about it being too little. Why would I blame them for any of that? It is only uninformed HN posters imagining that vulnerabilities are worth millions of dollars on some imaginary black market that are complaining about it. Just like they do with every vulnerability disclosure that mentions the size of the bounty. And by repeating this low-value conversation for the hundredth tube, you (yes, the specific you) are just hijacking the conversation and taking attention from what is unique and interesting about this case into your fantasy grievances about the bounty being too small.
  - supriyo-biswas 4y ago
    No need for the ad hominem attacks about “uninformed HN posters”. Zerodium and their likes are ready to enter discussions with you for paying ~ $X million given a sufficiently high impact vulnerability, which I strongly believe this is.
  - Ensorceled 4y ago
    > you (yes, the specific you) are just hijacking the conversation and taking attention from what is unique and interesting about this case into your fantasy grievances about the bounty being too small Well, good morning to you as well. Anyway, the conversation had turned to the topic of remuneration. You didn't reply with THIS comment originally, you joined right in and defended Microsoft's payment terms. If you thought this thread of conversation was "taking attention away" why did you wallow into the mud with the rest of us?
rvz 4y ago
A $40K bounty from a $2TN dollar company for this bug is like feeding pocket lint to sniffer dogs. These researchers would get more from re-selling the exploit from dark web criminals than this bug bounty program.
- azalemeth 4y ago
  Forget darkweb criminals, for something that juicy you can bet that nation states would be very interested. I don't know what China's equivalent of the NSA is, but if they're half competent they'd provide serious wonga for a bug like that one.
ryanjshaw 4y ago
I don't follow your argument. We are discussing whether the bounty is high enough to provide a good incentive for researchers to pick up and report issues like this timeously. It's impossible to know if anybody else has been abusing this for some time or not, and it's a valid concern for people here to argue the bounty is low enough that this kind of valuable exploit may have ended up on an exploit marketplace in the interim.

by jsnell 4y ago

flangola7 4y ago

Or they did it out of moral reasons, which is not something every discoverer of vulnerabilities will care about

jsnell 4y ago
If their motive wasn't the bounty, and it is just an unexpected bonus, why complain about it being too small?
- joosters 4y ago
  The researchers didn't complain about the bounty, AFAIK.
  - jsnell 4y ago
    I know. That's the entire point. It is just HN complaining on their behalf, unsolicited.
    - inferiorhuman 4y ago
      So. What. $40,000 is something that a senior SDE could pay out themselves without flinching. A trillion dollar company like MSFT should do better than that for something so severe. Put another way: just because the researchers didn't (publicly) complain doesn't put MSFT in the right here. There are more than a few kernel developers who didn't raise hell about Linus' abusive behavior. Yet even Linus himself realized his behavior had to change.
    - ethanwillis 4y ago
      It's almost as if HN is a site where we discuss things instead of just passively consuming information. In either case only paying $40,000 for disclosing an exploit like this sends a clear message from Microsoft. They don't take their user's security seriously. And it also incentivizes certain outcomes -- They're cheap and less moral actors who are only motivated by the finanical reward won't bother to engage with Microsoft. Use Microsoft products at your own peril.
Godel_unicode 4y ago
Wiz.io is a cloud security company which directly competes with Microsoft’s own offerings. They do this type of research as a marketing expense.

Ensorceled 4y ago

> It doesn't seem out of line with the published award scales And yet, it still seems out of line with the scope of the vulnerability. "seems" implies a subjective measurement. > If the researchers weren't ok with that bounty, they shouldn't (and wouldn't!) Researchers are going to research. Please don't carry water for trillion dollar companies; the reward was paltry don't blame the researchers for Microsoft's cheapness.

jsnell 4y ago
I'm not blaming the researchers for anything. They did the research, found a major issue, and got a reward in line with the published expectations, and have not complained about it being too little. Why would I blame them for any of that? It is only uninformed HN posters imagining that vulnerabilities are worth millions of dollars on some imaginary black market that are complaining about it. Just like they do with every vulnerability disclosure that mentions the size of the bounty. And by repeating this low-value conversation for the hundredth tube, you (yes, the specific you) are just hijacking the conversation and taking attention from what is unique and interesting about this case into your fantasy grievances about the bounty being too small.
- supriyo-biswas 4y ago
  No need for the ad hominem attacks about “uninformed HN posters”. Zerodium and their likes are ready to enter discussions with you for paying ~ $X million given a sufficiently high impact vulnerability, which I strongly believe this is.
- Ensorceled 4y ago
  > you (yes, the specific you) are just hijacking the conversation and taking attention from what is unique and interesting about this case into your fantasy grievances about the bounty being too small Well, good morning to you as well. Anyway, the conversation had turned to the topic of remuneration. You didn't reply with THIS comment originally, you joined right in and defended Microsoft's payment terms. If you thought this thread of conversation was "taking attention away" why did you wallow into the mud with the rest of us?

rvz 4y ago

A $40K bounty from a $2TN dollar company for this bug is like feeding pocket lint to sniffer dogs. These researchers would get more from re-selling the exploit from dark web criminals than this bug bounty program.

azalemeth 4y ago
Forget darkweb criminals, for something that juicy you can bet that nation states would be very interested. I don't know what China's equivalent of the NSA is, but if they're half competent they'd provide serious wonga for a bug like that one.

ryanjshaw 4y ago

I don't follow your argument. We are discussing whether the bounty is high enough to provide a good incentive for researchers to pick up and report issues like this timeously. It's impossible to know if anybody else has been abusing this for some time or not, and it's a valid concern for people here to argue the bounty is low enough that this kind of valuable exploit may have ended up on an exploit marketplace in the interim.