4 ms·
> Because it's pretty much an industry standard now, for those with a prominent web presence, to have an official bug bounty program This is so wrong, it's not
by daeken 13y ago
> Because it's pretty much an industry standard now, for those with a prominent web presence, to have an official bug bounty program
This is so wrong, it's not even funny. Bug bounty programs are awesome -- I've participated in many of them -- but they're a tiny, tiny, TINY minority. Of the top 500 websites, how many have bug bounties? 10? That's not an industry standard; it's a nicety.
That's changing, but seriously, there's absolutely nothing wrong with not having a bug bounty program right now.
- k3n 13y agoAye, good point, perhaps I should have said "...is quickly becoming the standard". However, would it be fair to say that a majority of Yahoo's competitors have bounty programs? Google, Microsoft, etc.
- daeken 13y agoMicrosoft has done some extremely limited bug bounties, but zero on the web side of things. Google, yes. But there are tons of major sites that don't have them, even the engineering-focused ones. Twitter being a great example.