> Furthermore, this value is decided upon after the work has been completed, and has been provided to the company. In what other industries is this the case?

Those "mail us your gold" ads on TV.

Hospitals do this, but backwards. The service provider gets to set the price.

Basically only in America, though. Elsewhere the situation where someone gets into a car wreck, goes to hospital and then gets told how broke they are now just doesn't exist.

In much of the rest of the world, the health system sets and publishes the rates - and guarantees payment to service providers. The doctors perform the services, and then submit for renumeration directly to the health system. The patients, well, they're sick and don't have to worry about any of it.

Side note, just fyi, because I used to make the exact same (tiny) mistake all the time. It's spelt remuneration rather than renumeration.

I think it helps to think of the `muner` part as being derived from the same root word as money rather than `numer` as number (which had been my previous assumption I guess).

You just inspired me to actually google my memory technique above, and it turns out the `mun` is from a latin root word for gifting (think munificent)[0]

So now I can think of a munificent monetary remuneration, and should remember it!

[0] https://www.merriam-webster.com/dictionary/remuneration#:~:t...

Thanks! I think I’d have been typing it wrong for the rest of my life had you not pointed this out haha.

Most developing countries are moving to the US model - private hospitals in India, China and the Middle East, for instance.

What baffles me is how expensive government hospitals too are in the US.

It's not about whether the hospitals are private or not, it's whether you know the price beforehand and can make an informed choice - the most basic thing about the free market.

Funny how everybody began to downvote me after totally misunderstanding my point in muddled fashion.

I wasn't talking about hospitals going private - after all, there are private hospitals in Europe and the UK too. I was talking about poor price transparency in the US being adopted in all of those places by private players. I specifically called out government players in the US, since they engage in the same practice, while government hospitals in all of those countries do not.

Pretty sure they make you an offer on the gold that you can decline. Probably still predatory but I think you are mistaken

> triagers have a whole pile of crap to wade through, to get to the useful material.

This is very true.

> The issues with bug bounties as a whole is the market is skewed. For any work done by a bug bountier, there is exactly one legitimate buyer who gets to make a significant judgement call on the value of the work done.

The problem, in my experience, is that they never analyze it by its potential. Why would they, they have the details now and usually your legal details so if it leaks they'll have you busted in a heartbeat and sued for contract violation.

> Furthermore, it really is hard to place an accurate monetary value on a bug that's responsibly reported

I submit that from my experience threat modelling this is actual dead simple but nobody feels the need to do it.

> What precisely is the monetary loss from ...

As you point out, the issue is that there's a single buyer. You really need to open up the bidding. If you trusted a Russian mob to pay residuals (and they probably would) you might be able to sell this for what ended up being $50M+, and the criminals could clear billions if done right. Then the next time something like this came up you'd have more bargaining power. If the company was still there...

Thomas is right that there isn't specifically a market like flippa for exploits but there are dark markets and many of the vendors would be open to a chat. I'm not rooting for this, I'm just not blind and it will happen. (Well, if it's Twitter I'm rooting a little...)

IMHO it’s only a matter of time until someone blows up a unicorn just for the thrill of it. That’s not something I’d support, but I won’t feel bad for companies that don’t pay adequate bug bounties.

You mean like cracking the most lucrative accounts on Twitter and then stealing Bitcoin? https://www.wired.com/story/inside-twitter-hack-election-pla...

As of right now, what is the lasting damage done to twitter by that attack? My argument is that it honestly wasn't that much, and thus bugs capable of that amount of damage aren't valued that much either.

There is plenty of price competition for your bug disclosure: the Chinese, the Israelis, the Saudis, the Americans, OR directly to Apple. :-)

Yeah let me just call up Saudi intelligence real quick, what's the name in the yellow pages?

Just mention MBS on a WhatsApp chat to a Saudi journalist, they find you.

He said legitimate.