I still consider these fees way too low. I understand there are not too many legal buyers for Windows bugs, but wonder whether it is more profitable from a financial pov to just disclose bugs as an upfront investment and wait for a PR disaster to have some actual leverage to negotiate fair prices.
Announcing the Windows Bounty Program
101–110 of 121 posts
Re: Announcing the Windows Bounty Program
#102Earlier quoted context omitted.
To begin with, some OSS doesn't even know how to treat people who report bugs.
The average OSS project probably is better about that than the average software company though - at least with OSS projects you can be reasonably secure that they won't send lawyers or the police after you for finding bugs.
It is also easier for an outsider to figure out where to report the bug.
I had a bug using NLTK to display parse trees in Jupyter notebooks. NLTK uses tkinter to render the parse trees to PostScript and GhostScript to produce a png image. The chain broke when the PostScript output had a font size of 0.
If this had been a bug in a closed-source program, all I could have put in a bug report would have been "doesn't work, pls fix".
Instead, I could submit a workaround to NLTK and start looking for the reason tkinter generated malformed PostScript output. This turned out to be because Tcl/Tk's font handling used Xft, which used FontConfig, and used an integer for the font size where FontConfig expected a double. Everything worked fine until FontConfig started doing floating point math on the font size. The Tk maintainer who triaged my bug report couldn't even reproduce it on his system, because his version of FontConfig only ever copied the value.
Only because every component of the chain was open source, was it possible to track the bug down and fix it.
Re: Announcing the Windows Bounty Program
#103I've come to feel that a Windows 10 machine is more secure than an OSX machine, all else being equal.
That's interesting.
Care to elaborate?
Re: Announcing the Windows Bounty Program
#104Earlier quoted context omitted.
Yes, with some effort: https://github.com/drduh/macOS-Security-and-Privacy-Guide You probably could with the same amount of effort for Windows, but at least Windows makes it more clear that it is happening.
As far as telemetry goes, there is a simple on or off checkbox in the Security and Privacy control panel.
This is somewhat misinformed. http://www.computerworld.com/article/3159424/microsoft-windo...
Re: Announcing the Windows Bounty Program
#105> If a researcher reports a qualifying vulnerability already found internally by Microsoft, a payment will be made to the first finder at a maximum of 10% of the highest amount they could’ve received (example: $1,500 for a RCE in Edge, $25,000 for RCE in Hyper-V) Wow. I guess this kind of functions as hush money? To make sure they don't reveal the issue before MS patches it. But still, this seems like a good move.
It also encourages researchers to do research, by making it less likely they'll do a pile of research only to be told "sorry, we already found this, you get nothing". Right now, pursuing a bounty is a risky proposition; this makes it less risky.
1/10th of what you expected is close to nothing though.
Re: Announcing the Windows Bounty Program
#106I still consider these fees way too low. I understand there are not too many legal buyers for Windows bugs, but wonder whether it is more profitable from a financial pov to just disclose bugs as an upfront investment and wait for a PR disaster to have some actual leverage to negotiate fair prices.
If the PR disaster already happened why would they pay you? Makes no sense.
Re: Announcing the Windows Bounty Program
#107Bounties for Edge? Isn't it less than 5% in browser market share? I like the fact they're offering a bounty program, I'm just surprised Edge was included I guess.
If Edge would be a more responsive on tab-switching and would have devtools on par with Chrome I would use it and I guess a lot of others would too. It's going to the right direction.
Re: Announcing the Windows Bounty Program
#108Re: Announcing the Windows Bounty Program
#109Earlier quoted context omitted.
On the other side, e.g. Egor Homakov hacked GitHub a few times through vulnerabilities in Rails. GitHub paid him bounties anyway. I'm no expert, but it appears to me that at times it does work, just not always.
Is github itself open source tho?
No, but a company paid a bounty for a leak in Rails, which is open source. Isn't that what this topic was about?
Re: Announcing the Windows Bounty Program
#110I still consider these fees way too low. I understand there are not too many legal buyers for Windows bugs, but wonder whether it is more profitable from a financial pov to just disclose bugs as an upfront investment and wait for a PR disaster to have some actual leverage to negotiate fair prices.
If the PR disaster already happened why would they pay you? Makes no sense.
Sorry, I mean the next time around, e.g if you are sitting on a couple of exploits.
250k is like the salary of a random manager, for me it really puts into perspective the strong commitment to security when they offer 15k (a monthly paycheck) for a rce in Edge potentially affecting millions of computers. Nevermind the fact finders are at the mercy of MS who can award whatever they want or simply claim it was found internally.