Announcing the Windows Bounty Program

Re:Announcing the Windows Bounty Program by a_imho on Thursday July 27, 2017 @03:19AM (#14863275)

I still consider these fees way too low. I understand there are not too many legal buyers for Windows bugs, but wonder whether it is more profitable from a financial pov to just disclose bugs as an upfront investment and wait for a PR disaster to have some actual leverage to negotiate fair prices.

[ Parent | on HN ]

Re:Announcing the Windows Bounty Program by romanovcode on Thursday July 27, 2017 @08:35AM (#14864655)

If the PR disaster already happened why would they pay you? Makes no sense.

[ Parent | on HN ]

Re:Announcing the Windows Bounty Program by a_imho on Thursday July 27, 2017 @10:01AM (#14865305)

Sorry, I mean the next time around, e.g if you are sitting on a couple of exploits. 250k is like the salary of a random manager, for me it really puts into perspective the strong commitment to security when they offer 15k (a monthly paycheck) for a rce in Edge potentially affecting millions of computers. Nevermind the fact finders are at the mercy of MS who can award whatever they want or simply claim it was found internally.

[ Parent | on HN ]