Re:Announcing the Windows Bounty Program
by crazcarl on Wednesday July 26, 2017 @03:12PM
(#14859209)
I wonder how often it happens that a company lies (or stretches the truth) about already knowing about a vulnerability to avoid paying a bounty. If it happens even sometimes, the 10% might provide additional incentive for researches to target Microsoft. Even if they don't get a full payout, at least they get something.
[ Parent
| on HN ]
Re:Announcing the Windows Bounty Program
by 43224gg252 on Wednesday July 26, 2017 @04:01PM
(#14859718)
A company would never lie. Especially Microsoft.
Microsoft is not lying about vulnerability discovery.
Re:Announcing the Windows Bounty Program
by canadianwriter on Wednesday July 26, 2017 @04:12PM
(#14859810)
My sarcasm detector is acting a little wonky - there is no real reason for Microsoft to lie about this, it isn't exactly breaking the bank for them.
Re:Announcing the Windows Bounty Program
by albinofrenchy on Thursday July 27, 2017 @02:10AM
(#14863021)
I very much doubt they would lie about it; but if the amount in question was so little that they wouldn't care about it, they would just pay the full price.
Re:Announcing the Windows Bounty Program
by devrandomguy on Wednesday July 26, 2017 @04:29PM
(#14859993)
Microsoft is composed of people. The people we worry about here, are the ones who might be incentivised to discover exploits before an outsider. They would have an incentive to back-date their work, or their subordinate's work.
Re:Announcing the Windows Bounty Program
by Analemma_ on Wednesday July 26, 2017 @05:51PM
(#14860690)
They're not stupid. If they cared so much more about pinching every last dollar than about security, they wouldn't have launched the bug bounty program at all.
BTW, as others have mentioned, this is strictly better than the policy of other bug bounties until now, which is "We already found this, so you get nothing"