3 ms·

Because it’s worth 36% of revenue? Google is not unsophisticated, if it was worth less they would pay less.

thaumasiotes 3y ago
> Google is not unsophisticated, if it was worth less they would pay less. That isn't how relationships work, regardless of sophistication. There was a link yesterday about bug bounties, so here's a story from my time handling bug bounties: 1. A major website published a policy setting out their payment schedule for various types of vulnerabilities. 2. A particular researcher submitted an issue which he plausibly characterized as falling into a high-value class of vulnerabilities. He received an award based on that classification. 3. The same guy continued to find vulnerabilities on that platform. He would always include a discussion of how to use his new vulnerability to implement an attack in the high-value category. There was an obvious reason for this: his typical vulnerability was a bog-standard cross site scripting attack, and XSS was specifically listed in the payment schedule as less valuable than the attack type this researcher wanted to be paid for. 4. Every time one of these reports came in, I would forward it to the company with the note "This is a standard cross-site scripting attack, and your policy specifies that it is worth a bounty of $XXX. The researcher notes that this vulnerability can be used to implement an attack with effect Y, and he is correct, but this is true of all cross-site scripting attacks on your site." 5. Then the company would pay out the higher-value bounty. So this is an example of the value of the report being set unambiguously in public, and a large, "sophisticated" company deliberately ignoring that because they didn't want to adjust their relationship with one particular researcher. (Other researchers reporting identical vulnerabilities didn't know the magic words; they got the listed payout for XSS.)

> Google is not unsophisticated, if it was worth less they would pay less. That isn't how relationships work, regardless of sophistication. There was a link yesterday about bug bounties, so here's a story from my time handling bug bounties: 1. A major website published a policy setting out their payment schedule for various types of vulnerabilities. 2. A particular researcher submitted an issue which he plausibly characterized as falling into a high-value class of vulnerabilities. He received an award based on that classification. 3. The same guy continued to find vulnerabilities on that platform. He would always include a discussion of how to use his new vulnerability to implement an attack in the high-value category. There was an obvious reason for this: his typical vulnerability was a bog-standard cross site scripting attack, and XSS was specifically listed in the payment schedule as less valuable than the attack type this researcher wanted to be paid for. 4. Every time one of these reports came in, I would forward it to the company with the note "This is a standard cross-site scripting attack, and your policy specifies that it is worth a bounty of $XXX. The researcher notes that this vulnerability can be used to implement an attack with effect Y, and he is correct, but this is true of all cross-site scripting attacks on your site." 5. Then the company would pay out the higher-value bounty. So this is an example of the value of the report being set unambiguously in public, and a large, "sophisticated" company deliberately ignoring that because they didn't want to adjust their relationship with one particular researcher. (Other researchers reporting identical vulnerabilities didn't know the magic words; they got the listed payout for XSS.)