3 ms·

I'm kind of curious: do these bug bounty "spray and pray" tactics actually make money? I can't help but wonder if people are doing it because it works, or if it

• bombcar 2y ago
  It’s incredibly low effort and for the people doing it even one hit in ten thousand could be multiple years’ wages.
  • kstrauser 2y ago
    Exactly. It's basically spam: there's nearly no cost to send it, so even an abysmal success rate is likely to return a fat profit. I've heard that the average reward is about $500. You can afford a lot of rejections per success at that rate. Never mind that you're destroying the effectiveness of those programs, driving staff nuts, and generally making the world less secure; that's their problem, right? (Sarcasm, obv.)