full-disclosure - Re: OT Google raises sploit bounties

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAP145phKCZRqJJDA6QgfaCmauU3zdcCXLQgHOgJmO5W0OxJNKA@mail.gmail.com>
Date: Mon, 26 Nov 2012 18:48:17 +0100
From: Robert Święcki <robert@...ecki.net>
To: Michal Zalewski <lcamtuf@...edump.cx>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: OT Google raises sploit bounties

On Mon, Nov 26, 2012 at 7:17 AM, Michal Zalewski <lcamtuf@...edump.cx> wrote:
>> His question seemed pretty clear to me. As indicated in the article he
>> linked to, Google apparently raised their bounty/reward. He's asking if
>> something happened to one of their products to cause that, or if they're
>> just paranoid (and maybe expecting something to happen to one of their
>> products).
>
> FWIW, these choices seem weird... for any announcement of that sort,
> it seems more rational to assume any of the following:
>
> 1) It's getting harder to find bugs. Reward amounts correspond to the
> average time needed to locate a vuln.
>
> 2) More reward programs are competing for a fixed pool of skilled
> researchers. Reward amounts are just "bids" for their time.
>
> 3) Incoming reports are surprisingly good. Reward amounts are set to
> recognize high quality work.
>
> 4) The vendor thinks that their product is bulletproof, and uses
> increasing reward amounts as a publicity stunt.
>
> As far as I know, all reward increases for Google VRPs were driven by
> a combination of factors 1 through 3.

Please stop ridiculling conspiracy theories with reasonable arguments
:). No fun.

> I am not sure how "being paranoid" factors in - complex products have
> bugs, browsers doubly so. Similarly, malware seems like a weird reason
> to bump up rewards.
>
> /mz
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/



-- 
Robert Święcki

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/