Re: OT Google raises sploit bounties

[Georgi Guninski <guninski () guninski com>]

On Mon, Nov 26, 2012 at 06:48:17PM +0100, Robert Święcki wrote:
> On Mon, Nov 26, 2012 at 7:17 AM, Michal Zalewski <lcamtuf () coredump cx> wrote:
> > > His question seemed pretty clear to me. As indicated in the article he
> > > linked to, Google apparently raised their bounty/reward. He's asking if
> > > something happened to one of their products to cause that, or if they're
> > > just paranoid (and maybe expecting something to happen to one of their
> > > products).
> >
> > FWIW, these choices seem weird... for any announcement of that sort,
> > it seems more rational to assume any of the following:
> >
> > 1) It's getting harder to find bugs. Reward amounts correspond to the
> > average time needed to locate a vuln.
> >
> > 2) More reward programs are competing for a fixed pool of skilled
> > researchers. Reward amounts are just "bids" for their time.
> >
> > 3) Incoming reports are surprisingly good. Reward amounts are set to
> > recognize high quality work.
> >
> > 4) The vendor thinks that their product is bulletproof, and uses
> > increasing reward amounts as a publicity stunt.
> >
> > As far as I know, all reward increases for Google VRPs were driven by
> > a combination of factors 1 through 3.
>
> Please stop ridiculling conspiracy theories with reasonable arguments
> :). No fun.

One Google employee responds to another Google employee about Google
stuff...

Let's watch the price of the sploits, probably time will tell.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/