Comment by 0xbadcafebee
5 hours ago
How much money is lost by consumers/businesses for every hour the vulnerability is exploited in the wild with no patch?
5 hours ago
How much money is lost by consumers/businesses for every hour the vulnerability is exploited in the wild with no patch?
The value of the report is dependent on the scarcity of the knowledge. If anybody can report it, the bid goes down.
How do you figure? The value of the report is, ethics aside, the same as the value of exploiting it. Doesn’t matter if I can conceive of it, it matters if I can exploit it.
The value of future reports should also be a component though. By paying a low amount you discourage ethical bug bounty hackers from bothering to look for more exploits. If I think I'm only getting $1000 for a Chrome issue versus $100,000 for an Acme Co issue, I'll be spending my time looking for Acme Co issues.
Bug bounties are as much a way of attracting talent to even try to exploit your system as they are about the exploits themselves. If you lowball the bounties the talent goes elsewhere.
There is a theta decay component. The zero day is highly valuable until known; once known, its value rapidly declines to zero.
That’s not how things are valued. That’s moreso how the absence of something is valued.
Go without air for a few minutes and you’ll die, and yet they give the stuff away for free.
Stop giving them ideas.