3 ms·

I'm not blaming the researchers for anything. They did the research, found a major issue, and got a reward in line with the published expectations, and have not

by jsnell 4y ago

I'm not blaming the researchers for anything. They did the research, found a major issue, and got a reward in line with the published expectations, and have not complained about it being too little. Why would I blame them for any of that? It is only uninformed HN posters imagining that vulnerabilities are worth millions of dollars on some imaginary black market that are complaining about it. Just like they do with every vulnerability disclosure that mentions the size of the bounty. And by repeating this low-value conversation for the hundredth tube, you (yes, the specific you) are just hijacking the conversation and taking attention from what is unique and interesting about this case into your fantasy grievances about the bounty being too small.

supriyo-biswas 4y ago
No need for the ad hominem attacks about “uninformed HN posters”. Zerodium and their likes are ready to enter discussions with you for paying ~ $X million given a sufficiently high impact vulnerability, which I strongly believe this is.
Ensorceled 4y ago
> you (yes, the specific you) are just hijacking the conversation and taking attention from what is unique and interesting about this case into your fantasy grievances about the bounty being too small Well, good morning to you as well. Anyway, the conversation had turned to the topic of remuneration. You didn't reply with THIS comment originally, you joined right in and defended Microsoft's payment terms. If you thought this thread of conversation was "taking attention away" why did you wallow into the mud with the rest of us?
mr_mitm 4y ago
> some imaginary black market It's neither imaginary nor black. They list their prices on their website: https://zerodium.com/program.html https://zerodium.com/program.html
adql 4y ago
> It is only uninformed HN posters imagining that vulnerabilities are worth millions of dollars on some imaginary black market that are complaining about it. Just like they do with every vulnerability disclosure that mentions the size of the bounty. Sure normally it is a joke but this one in particular does look like something that would actually be worth something to the right buyer

by jsnell 4y ago

supriyo-biswas 4y ago

No need for the ad hominem attacks about “uninformed HN posters”. Zerodium and their likes are ready to enter discussions with you for paying ~ $X million given a sufficiently high impact vulnerability, which I strongly believe this is.

Ensorceled 4y ago

> you (yes, the specific you) are just hijacking the conversation and taking attention from what is unique and interesting about this case into your fantasy grievances about the bounty being too small Well, good morning to you as well. Anyway, the conversation had turned to the topic of remuneration. You didn't reply with THIS comment originally, you joined right in and defended Microsoft's payment terms. If you thought this thread of conversation was "taking attention away" why did you wallow into the mud with the rest of us?

mr_mitm 4y ago

> some imaginary black market It's neither imaginary nor black. They list their prices on their website: https://zerodium.com/program.html https://zerodium.com/program.html

adql 4y ago

> It is only uninformed HN posters imagining that vulnerabilities are worth millions of dollars on some imaginary black market that are complaining about it. Just like they do with every vulnerability disclosure that mentions the size of the bounty. Sure normally it is a joke but this one in particular does look like something that would actually be worth something to the right buyer