Comment by tantalor
5 hours ago
The value of the report is dependent on the scarcity of the knowledge. If anybody can report it, the bid goes down.
5 hours ago
The value of the report is dependent on the scarcity of the knowledge. If anybody can report it, the bid goes down.
How do you figure? The value of the report is, ethics aside, the same as the value of exploiting it. Doesn’t matter if I can conceive of it, it matters if I can exploit it.
The value of future reports should also be a component though. By paying a low amount you discourage ethical bug bounty hackers from bothering to look for more exploits. If I think I'm only getting $1000 for a Chrome issue versus $100,000 for an Acme Co issue, I'll be spending my time looking for Acme Co issues.
Bug bounties are as much a way of attracting talent to even try to exploit your system as they are about the exploits themselves. If you lowball the bounties the talent goes elsewhere.
There is a theta decay component. The zero day is highly valuable until known; once known, its value rapidly declines to zero.