Comment by summarity
8 years ago
Not only that, but the "reward" in the program is laughable and frankly insulting to any serious researcher considering the scope of CF. Bug bounty platforms are already becoming the fiverr of ITSEC (that's not a good thing), CF just made an extra effort do diminish the value for researchers.
Management: "Why do we offer $5k for a small bug again? Look at CF, they don't offer any money!"
> "Why do we offer $5k for a small bug again? Look at CF, they don't offer any money!"
Answer: "Because if they had set up a bounty of $50k for security issues, they'd had thousands of researchers/students/white hats etc. watching the output of their servers."
"...and could maybe avoid or lessen the impact of this fiasco."
I don't disagree.
But, Taviso is probably contractually prohibited from accepting money from CF as a Google employee. Many large companies have 'outside activity' clauses and Google seems to be paying him already for that.
However, it will affect others whom are fully freelance.
If serious researchers are looking to get paid, I think bug bounties are the wrong approach entirely
It's about payoff * probability.
Let's say I (an idiot, but knowledgeable enough) stumble upon a serious vulnerability in Google.
Option 1: I could try to sell that on a darknet market for a decent amount of money. State actors, hacker groups, lots of people want to pay for such things to exploit. But, I might not get paid very much, I might get screwed over, I might go to jail, who the heck knows, I'm playing with a bit of fire here. Could make a good pay day though.
Option 2: Google offers a bug bounty that is known to pay well. It probably offers guidance on how much my exploit is worth. They'll almost certainly pay. And hey, no one gets exploited, which most people feel is a good thing.
Value = payout * probability. If bug bounties pay well, option 2 has a higher value most of the time. But if a company offers t-shirts, or is known for screwing over the discoverer, the perceived value falls quickly.
That's why companies who take security seriously pay good bounties, loudly and publicly.
> I might go to jail
Is selling exploits illegal? If so is selling them to google also illegal?
3 replies →
Why? Many can help find problems without having to be full-time, that's the point of crowd-sourcing with payouts.
Because you'll make much more working for people who specifically hire you instead of doing a bunch of risky work on spec.
4 replies →
A lot of pentesters make good money off bounty hunting. Some months they make more money off hunting than they do their day job.