They are not setting a very good precedent with this that's for sure. Not everyone will be as white hat as this guy and opt for a little more value. Would this have been even an illegal thing to do per se? Could companies have sued him for lost profit? Anyway even 100k would have been nothing to google. You shouldnt try to be cheapskate with this.

> they took advantage of the reporter’s good faith and benevolent motivations.

Someone with truly benevolent motivations does good things because they believe it's the right thing to do -- not because of a monetary reward. I'm not saying they shouldn't pay him more, but I think it's going a bit far to say they're "taking advantage of him".

If I find a wallet on the ground and there's $200 cash in it, I'll return it to the owner and leave all the money there. I don't expect a reward and certainly don't feel like I'm being taken advantage of if they don't give me some of that $$.

Yeah, but you might feel differently if instead of $200 it had $10m cash. And instead of accidentally coming across it on the ground, you spend months of your own time just walking the streets looking for such a wallet to return. And also the owner is one of the richest men in the world.

I'm not suprised at all that Google rewarded this low. This is why they are always be more blackhat SEO then reporters. Because companies are too cheap to realize how valuable this discoveries are. They are getting too greedy. I agree 100% that this should of been at least $1,000,000 if not much more. If this contenues google could be the next Facebook ^_^ Lets use DuckDuckGo instead everyone ;-)

Good point. Google probably argued its just an Open Redirect, whereas its an elevation (in the site ranks) with immediate impact on site owners. Hope Google makes this right for the finder and hands out an elevation payout (it's possible to bend your own rules, I doubt this kind of finding is in their typical payout matrix)

Yeah, I'm not sure how well it fits in their matrix, though they do have a column for:

This category includes products such as Google Search

But it is probably intended to mean the front end of it, rather than the ranking algorithm.

There is definitely an asymmetry between the entity that posts a bug bounty and the hunter of that bounty. It's the principal-agent problem: The entity that posts the bounty is also the same agent that decides whether to hand out the bounty or not. The bounty in most cases is variable so it's in their best interest to make some attempt to withhold the bounty by arguing for a lower-valued classification or no classification of the bug.

Perhaps it would make sense for a third-party "bounty escrow" agency to exist. The escrow agency may be able to provide impartial arbitration of the exploit, and this may have the side effect of coming to a decision faster and promoting a quicker actual bug fix for the end-users.

His console says 33.2k of ad buys. I'd say it's worth at least that much to them.

It's literally their numbers spitting out how much it would have cost!

But hey, at least it's Leet.

$31337 should have been minimum payout. Think of the software download rankings..

It was a SEMRush screenshot, not related to Google, so it wasn't their numbers.

Apologies. Definitely an estimated start.

Well I don’t know if it lost (Google) revenue (interested in understanding how if actually so? maybe missing something), but yeah it was definitely worth a lot of money to anyone who knew of it as a 0-day, and would have been lost traffic/revenue for the serps being bumped down.

This is a pretty cool exploit.