3 ms·
The payment was apparently USD 33'500. Not being in the bug bounty business, I had expected a higher payment.
by chmars 13y ago
The payment was apparently USD 33'500.
Not being in the bug bounty business, I had expected a higher payment.
- hueving 13y agoNot bad for 2 days of work.
- nikcub 13y agoThe part of the work you don't see is the hours, days and months spent, usually unpaid, spent auditing code to find the bugs. It is like the anecdote of Tesla and Ford and knowing where to put the X[0], you aren't paying for time or manual labour - bug value is derived from how much damage it can cause, what its worth to Facebook to not be exploited and what the exploit is worth to the bad guys on the black market. [0] http://www.snopes.com/business/genius/where.asp http://www.snopes.com/business/genius/where.asp
- skittles 13y agoSo would you rather pay a master $33,500 for 2 days of work or a novice $33,500 for a year of work (and possibly no results)?
- chmars 13y agoYou pay for results, not for time. And you can use an existing market to define a price. Time is often used to measure compensation – lawyers are well known for being paid in hourly fees –, however, in the long run, only results counts. And concerning the market, for how much could this bug have been sold, for example to the NSA?
- callesgg 13y agoA decent amount of cash. I however believe he could easily have sold it on the black market for more. (Not saying that one should do such a thing.)
- snake_plissken 13y ago$33,500?
- chmars 13y agoSame. Same amount, different format!