Full Disclosure mailing list archives
Re: OT Google raises sploit bounties
From: Michal Zalewski <lcamtuf () coredump cx>
Date: Sun, 25 Nov 2012 22:17:18 -0800
His question seemed pretty clear to me. As indicated in the article he linked to, Google apparently raised their bounty/reward. He's asking if something happened to one of their products to cause that, or if they're just paranoid (and maybe expecting something to happen to one of their products).
FWIW, these choices seem weird... for any announcement of that sort, it seems more rational to assume any of the following: 1) It's getting harder to find bugs. Reward amounts correspond to the average time needed to locate a vuln. 2) More reward programs are competing for a fixed pool of skilled researchers. Reward amounts are just "bids" for their time. 3) Incoming reports are surprisingly good. Reward amounts are set to recognize high quality work. 4) The vendor thinks that their product is bulletproof, and uses increasing reward amounts as a publicity stunt. As far as I know, all reward increases for Google VRPs were driven by a combination of factors 1 through 3. I am not sure how "being paranoid" factors in - complex products have bugs, browsers doubly so. Similarly, malware seems like a weird reason to bump up rewards. /mz _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- OT Google raises sploit bounties Georgi Guninski (Nov 24)
- Re: OT Google raises sploit bounties Chris Evans (Nov 25)
- Re: OT Google raises sploit bounties adam (Nov 25)
- Re: OT Google raises sploit bounties Michal Zalewski (Nov 25)
- Re: OT Google raises sploit bounties Guifre (Nov 26)
- Re: OT Google raises sploit bounties Robert Święcki (Nov 26)
- Re: OT Google raises sploit bounties Georgi Guninski (Nov 27)
- Re: OT Google raises sploit bounties Dan Kaminsky (Nov 27)
- Re: OT Google raises sploit bounties Georgi Guninski (Nov 28)
- Re: OT Google raises sploit bounties Dan Kaminsky (Nov 28)
- Re: OT Google raises sploit bounties Michal Zalewski (Nov 28)
- Re: OT Google raises sploit bounties adam (Nov 25)
- Re: OT Google raises sploit bounties Chris Evans (Nov 25)
- Re: OT Google raises sploit bounties Thor (Hammer of God) (Nov 26)