3 ms·
The researchers didn't complain about the bounty, AFAIK.
by joosters 4y ago
The researchers didn't complain about the bounty, AFAIK.
- jsnell 4y agoI know. That's the entire point. It is just HN complaining on their behalf, unsolicited.
- inferiorhuman 4y agoSo. What. $40,000 is something that a senior SDE could pay out themselves without flinching. A trillion dollar company like MSFT should do better than that for something so severe. Put another way: just because the researchers didn't (publicly) complain doesn't put MSFT in the right here. There are more than a few kernel developers who didn't raise hell about Linus' abusive behavior. Yet even Linus himself realized his behavior had to change.
- ethanwillis 4y agoIt's almost as if HN is a site where we discuss things instead of just passively consuming information. In either case only paying $40,000 for disclosing an exploit like this sends a clear message from Microsoft. They don't take their user's security seriously. And it also incentivizes certain outcomes -- They're cheap and less moral actors who are only motivated by the finanical reward won't bother to engage with Microsoft. Use Microsoft products at your own peril.