3 ms·

there are a lot of freelance hackers. if companies pay more for bugs than the bad guys, it makes financial sense for hackers to sell bugs to the good guys. $10k

there are a lot of freelance hackers. if companies pay more for bugs than the bad guys, it makes financial sense for hackers to sell bugs to the good guys. $10k seems quite undervalued, and the only reason they're getting any is because of either 1) the moral code of the researchers who find them, or 2) because the prize is a bonus on top of their other motivations (e.g. bragging rights, research funded by governments or universities.) Zerodium pays out up to $200k for a Chrome RCE without sandbox escape. 20x more! that's insanely tempting.

Veserv 3y ago
It costs less than $10k to regularly find them. If it cost Google $200k per valid RCE report they would be absolutely flooded with reports of identified defects they would have to pay out and fix with no end in sight. They would be forced to reallocate feature development engineers and resources to fixing the security defects in Chrome. How will they get promotions if all they do is fix defects instead of shipping new features? To be less sarcastic, it would also not help. As I said earlier, a bug bounty does not cause quality improvements; you can not buy your way to low defect rates. What a high bug bounty does is provide incentive for high quality (otherwise you have to keep paying), third party validation (same as above), and a low-hanging net (to catch actual low cost flukes). Put another way, a bug bounty is a externally visible metric. It merely indicates and measures, it does not cause.