3 ms·
I think a good solution would be a generally accepted security flaw reward contract. If most corporations with an online presence adopted some uniform agreement
by saym 14y ago
I think a good solution would be a generally accepted security flaw reward contract. If most corporations with an online presence adopted some uniform agreement, we'd have a standardized method of report and reward.
- reginaldo 14y agoIt would be nice if they did so, but I don't think companies should be obligated to pay for bug reports from researchers that have no association whatsoever with them. Those that pay seem to get more reports, both in numbers and in quality, at least that's what Google says. Also, I think that a consumer should have the right to speak up when personal data is at risk, but that's a whole other story. In this case, I'm more worried about the "lots to lose" part than about the "nothing to win" one. For some reason I'm even fine with doing charity work for the benefit of billion-dollar corporations from time to time [1]. But not if there's the risk of them coming after me in the future... [1] http://technet.microsoft.com/en-us/security/cc308589.aspx http://technet.microsoft.com/en-us/security/cc308589.aspx