Why shouldn't full-disclosure'd bugs be eligible for NN% of the reward? (looking for strong arguments against it)
8
2
15
Replying to @sirdarckcat
Full disclosure means 24x7 effort by the company to patch, an investigation to see if ever exploited, and it may take their revenue source offline for some duration. No company wants a hard hit like that, why would the company then turnaround and reward the person responsible?

Jul 22, 2019 · 11:06 AM UTC

1
1
Replying to @bilcorry @sirdarckcat
You’d also need a “no exploit” clause to prevent someone from disclosing, then immediately exploiting it, to double-dip. Unless the company is superhumanly swift, there is a raised likelihood it will be exploited, causing no payout anyhow.
1
I wonder what the strong argument is for paying anything on full disclosure? Just to get the report of a bug? With full disclosure, you get it for free, unless you believe the reporter wouldn’t disclose at all?
1
more replies