2 ms·
> They should not be surprised if researchers sell those exploits instead of disclosing them. How would that work when OSS projects are also affected?
by jsiepkes 3y ago
> They should not be surprised if researchers sell those exploits instead of disclosing them.
How would that work when OSS projects are also affected?
- palata 3y agoPretty simple: - If the OSS project doesn't have any money and nobody who makes any money uses it, then no bounty. Also chances are that researchers will not spend time finding security issues in all the unused personal projects under the sun. Precisely because they are unused. - If the OSS project somehow has money, they should pay a bounty. But let's be honest, OSS projects usually receive contributions, not money. - If the OSS project is depended on by a company that makes profit, then the company should pay a bounty. Especially when it is a huge company making a ton of profit. Who cares if Microsoft have a security flaw in their own code or in code they depend on? They have a security flaw that can be exploited, it is a security problem for Microsoft. They pay security teams for that, and they should pay bounties just the same.