3 ms·

Nice work, but I hate how he has to say "Google should let me know next week whether this qualifies for a bounty; I’ll update this post when they do." -- He's t

Nice work, but I hate how he has to say "Google should let me know next week whether this qualifies for a bounty; I’ll update this post when they do." -- He's the one who did Google a favor! For him to have to be in this position where he's hoping for a bounty, and Google has no incentives to give him one is kinda a crappy position to be in. We need an intermediary for security exploits that can negotiate bounties before full information about the exploit is revealed. Perhaps something already exists?

f- 13y ago
Well, we have an official reward program with published criteria, and to a large extent, it's just a matter of reputation: if we were unfair or stingy, it would be a very short-sighted strategy. That aside, having another party getting advance knowledge about the bugs is risky: it just gives bad actors a juicy target to infiltrate to get a steady supply of 0-days.
primitivesuave 13y ago
Something doesn't exist because these companies do try to pay out very reasonable bug bounties to people who catch bugs. The more lucrative it is to find a bug and disclose it responsibly on Google, the more people will actually take the time and effort to do so.
TomAnthony 13y ago
OP here. I understand the essence of your point and agree with it to some extent, but I think in this instance I wasn't clear. Google are transparent about their process and let me know they'd vote on it at their next meeting. I've clarified the language in my post. The idea of an intermediary is an interesting one, certainly for smaller companies. However, for the company to be able to work out the value of the bug, they'd need to know enough details to 'score' the bug such they could maybe find it. Either way, you'd end up needing some trust. However, the idea of a service to manage all that for small companies is a good idea. It reminds me of the Common Vulnerability Scoring System (http://www.first.org/cvss http://www.first.org/cvss) for scoring such exploits.
- thetrb 13y ago
  In your case it would have been easy "I have an exploit that let's me get the e-mail address of every Google+ account". Then they could decide how much that's worth to them. But I also don't see how that would play out. If their offer is too low what would you do then? You can't sell it to someone else as this is most likely illegal and just keeping it for yourself is also not a great choice.

f- 13y ago

Well, we have an official reward program with published criteria, and to a large extent, it's just a matter of reputation: if we were unfair or stingy, it would be a very short-sighted strategy. That aside, having another party getting advance knowledge about the bugs is risky: it just gives bad actors a juicy target to infiltrate to get a steady supply of 0-days.

primitivesuave 13y ago

Something doesn't exist because these companies do try to pay out very reasonable bug bounties to people who catch bugs. The more lucrative it is to find a bug and disclose it responsibly on Google, the more people will actually take the time and effort to do so.

TomAnthony 13y ago

OP here. I understand the essence of your point and agree with it to some extent, but I think in this instance I wasn't clear. Google are transparent about their process and let me know they'd vote on it at their next meeting. I've clarified the language in my post. The idea of an intermediary is an interesting one, certainly for smaller companies. However, for the company to be able to work out the value of the bug, they'd need to know enough details to 'score' the bug such they could maybe find it. Either way, you'd end up needing some trust. However, the idea of a service to manage all that for small companies is a good idea. It reminds me of the Common Vulnerability Scoring System (http://www.first.org/cvss http://www.first.org/cvss) for scoring such exploits.

thetrb 13y ago
In your case it would have been easy "I have an exploit that let's me get the e-mail address of every Google+ account". Then they could decide how much that's worth to them. But I also don't see how that would play out. If their offer is too low what would you do then? You can't sell it to someone else as this is most likely illegal and just keeping it for yourself is also not a great choice.