lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20121128060718.GA2589@sivokote.iziade.m$> Date: Wed, 28 Nov 2012 08:07:18 +0200 From: Georgi Guninski <guninski@...inski.com> To: Robert Święcki <robert@...ecki.net> Cc: full-disclosure <full-disclosure@...ts.grok.org.uk> Subject: Re: OT Google raises sploit bounties On Mon, Nov 26, 2012 at 06:48:17PM +0100, Robert Święcki wrote: > On Mon, Nov 26, 2012 at 7:17 AM, Michal Zalewski <lcamtuf@...edump.cx> wrote: > >> His question seemed pretty clear to me. As indicated in the article he > >> linked to, Google apparently raised their bounty/reward. He's asking if > >> something happened to one of their products to cause that, or if they're > >> just paranoid (and maybe expecting something to happen to one of their > >> products). > > > > FWIW, these choices seem weird... for any announcement of that sort, > > it seems more rational to assume any of the following: > > > > 1) It's getting harder to find bugs. Reward amounts correspond to the > > average time needed to locate a vuln. > > > > 2) More reward programs are competing for a fixed pool of skilled > > researchers. Reward amounts are just "bids" for their time. > > > > 3) Incoming reports are surprisingly good. Reward amounts are set to > > recognize high quality work. > > > > 4) The vendor thinks that their product is bulletproof, and uses > > increasing reward amounts as a publicity stunt. > > > > As far as I know, all reward increases for Google VRPs were driven by > > a combination of factors 1 through 3. > > Please stop ridiculling conspiracy theories with reasonable arguments > :). No fun. > One Google employee responds to another Google employee about Google stuff... Let's watch the price of the sploits, probably time will tell. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists