3 ms·

3,133.7 is a great reward!

• seanw265 2y ago
  Is it? I'm not so familiar with the specifics of bug bounty programs, but it seems like this issue could cause much more than 3k in damages if it were to be exploited. Similarly, I'm kind of shocked that Google is only offering 30k for discoveries of remote code execution vulnerabilities on their own servers. I don't mean to trivialize that amount of money, but compared to the scope of what that kind of vulnerability could be used for it seems insignificant. There's the potential for access to internal Google secrets and private data belonging to users. Would a government not pay 10-20x for something like that?
  • kccqzy 2y ago
    Governments achieve code execution within Google by sending special agents to become employees of Google.
    • seanw265 2y ago
      I imagine that's orders of magnitude more expensive than paying these rates for an exploit.
• _lvbh 2y ago
  No it’s not! That is extremely low compared to say Apple, which doles out something like 50k for low severity bugs (source: they pretty much paid my college fees)
  • j0hnyl 2y ago
    This is not my experience with Apple at all.