mailing list archives
Re: OT Google raises sploit bounties
From: Georgi Guninski <guninski () guninski com>
Date: Wed, 28 Nov 2012 08:07:18 +0200
On Mon, Nov 26, 2012 at 06:48:17PM +0100, Robert Święcki wrote:
On Mon, Nov 26, 2012 at 7:17 AM, Michal Zalewski <lcamtuf () coredump cx> wrote:
His question seemed pretty clear to me. As indicated in the article he
linked to, Google apparently raised their bounty/reward. He's asking if
something happened to one of their products to cause that, or if they're
just paranoid (and maybe expecting something to happen to one of their
FWIW, these choices seem weird... for any announcement of that sort,
it seems more rational to assume any of the following:
1) It's getting harder to find bugs. Reward amounts correspond to the
average time needed to locate a vuln.
2) More reward programs are competing for a fixed pool of skilled
researchers. Reward amounts are just "bids" for their time.
3) Incoming reports are surprisingly good. Reward amounts are set to
recognize high quality work.
4) The vendor thinks that their product is bulletproof, and uses
increasing reward amounts as a publicity stunt.
As far as I know, all reward increases for Google VRPs were driven by
a combination of factors 1 through 3.
Please stop ridiculling conspiracy theories with reasonable arguments
:). No fun.
One Google employee responds to another Google employee about Google
Let's watch the price of the sploits, probably time will tell.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
Re: OT Google raises sploit bounties Nick Boyce (Nov 26)