3 ms·

Microsoft Windows: 5 bugs Microsoft IE 11: 4 bugs Mozilla Firefox: 3 bugs Adobe Reader: 3 bugs Adobe Flash: 3 bugs Apple Safari: 2 bugs

Microsoft Windows: 5 bugs Microsoft IE 11: 4 bugs Mozilla Firefox: 3 bugs Adobe Reader: 3 bugs Adobe Flash: 3 bugs Apple Safari: 2 bugs Google Chrome: 1 bug $442,500 paid out to researchers Looking at these figures, am I the only one who think competitions are not the most effective method for finding bugs? Of course, 21 bugs is not small and $442,500 is not much, but when you think those researches spend months of their time for finding those bugs, wouldn't it be more appropriate to use that money on proper security audits? (I know it will cost more but would be more effective overall?)

LLWM 12y ago
Proper audits don't get much publicity.
genericuser 12y ago
I consider the purpose of competitions like this to be as much about finding bugs as the purpose of running a marathon is to get people from point A to point B. That is competitions like this are mainly about public relations in the form of what is intended to be enjoyable community involvement, finding bugs is a pleasant side effect, like the transportation aspect of a marathon.
billyhoffman 12y ago
It's not 21 bugs. Anyone can find 21 bugs. It's 21 bugs that enable/facilitate Remote Code Execution. These are some of the worse of the worse. $442,000 is a steal to get these identified and fixed.
- NathanKP 12y ago
  Additionally those 21 bugs are probably worth way more than a measly $442k if sold on the blackmarket or to the NSA, etc.
  - Nitramp 12y ago
    Are there actually reliably numbers/analyses on that? I heard the sentiment many times, but I have seen no proof of it.
    - deleted 12y ago
      [deleted]
eugeneionesco 12y ago
Finding bugs is easy, exploiting them is a magnitude harder. This competition is about exploitation.