3 ms·

If their motive wasn't the bounty, and it is just an unexpected bonus, why complain about it being too small?

• joosters 4y ago
  The researchers didn't complain about the bounty, AFAIK.
  • jsnell 4y ago
    I know. That's the entire point. It is just HN complaining on their behalf, unsolicited.
    • inferiorhuman 4y ago
      So. What. $40,000 is something that a senior SDE could pay out themselves without flinching. A trillion dollar company like MSFT should do better than that for something so severe. Put another way: just because the researchers didn't (publicly) complain doesn't put MSFT in the right here. There are more than a few kernel developers who didn't raise hell about Linus' abusive behavior. Yet even Linus himself realized his behavior had to change.
    • ethanwillis 4y ago
      It's almost as if HN is a site where we discuss things instead of just passively consuming information. In either case only paying $40,000 for disclosing an exploit like this sends a clear message from Microsoft. They don't take their user's security seriously. And it also incentivizes certain outcomes -- They're cheap and less moral actors who are only motivated by the finanical reward won't bother to engage with Microsoft. Use Microsoft products at your own peril.