Microsoft Offers Bug Bounty to Prevent Another Spectre-Meltdown Fiasco

Re:Microsoft Offers Bug Bounty to Prevent Another Spectre-Me... by JoachimSchipper on Sunday March 18, 2018 @02:36AM (#16610715)

> I [showed] that the timer mitigation would not stop these vulnerabilities

Yes, that was obvious to people with some background in this class of attacks. Good on you for figuring that out independently (seriously!), but you're not going to get a bounty for something widely known.

[ Parent | on HN ]

Re:Microsoft Offers Bug Bounty to Prevent Another Spectre-Me... by WebLLL on Sunday March 18, 2018 @04:45AM (#16611011)

Ok, but if a working web browser POC is not worthy of a bug bounty reward, because they claim to already know, then what is the point of the bug bounty? Why are they not just paying for specialists to advise them on how to fix this if they have no plan. They don't even listen when you try and try and try to explained what needs to be done. How can a bug bounty fix this?

[ Parent | on HN ]

Re:Microsoft Offers Bug Bounty to Prevent Another Spectre-Me... by tgb on Sunday March 18, 2018 @08:25AM (#16611625)

The point is that the vendor was claiming they had patched the flaw. They can't simultaneously claim to have a patch and that they know the patch doesn't fix it.

[ Parent | on HN ]