A you-only-get-it-when-successful 20,000$ budget from Google is
insulting, considering the perhaps massive time investment from
the researcher. [...] and yet they only pay a nice researcher 20
grand? You can't even live on that. Researchers aren't just kids
with no responsibilities, they have mortgages and families
People who want to make a living helping to improve Google security
are welcome to apply for a job :-) We have a remarkably large and
interesting security team.
The program simply serves to complement that (and some other,
contract-driven efforts), and it works for quite a few people who see
it as a way to do something useful on the side, and get compensated
for it, too.
Now, I have done a fair amount of vulnerability research in my life, I
do have a family and a mortgage - and I still wouldn't see $20k as an
insult; but I know that this is subjective. In that spirit, you are at
liberty to determine whether to participate, and how much time to
invest into the pursuit :-)
Cheers,
/mz
From: Michal Zalewski
A you-only-get-it-when-successful 20,000$ budget from Google is
insulting, considering the perhaps massive time investment from
the researcher. [...] and yet they only pay a nice researcher 20
grand? You can't even live on that. Researchers aren't just kids
with no responsibilities, they have mortgages and families
People who want to make a living helping to improve Google security
are welcome to apply for a job :-) We have a remarkably large and
interesting security team.
The program simply serves to complement that (and some other,
contract-driven efforts), and it works for quite a few people who see
it as a way to do something useful on the side, and get compensated
for it, too.
Now, I have done a fair amount of vulnerability research in my life, I
do have a family and a mortgage - and I still wouldn't see $20k as an
insult; but I know that this is subjective. In that spirit, you are at
liberty to determine whether to participate, and how much time to
invest into the pursuit :-)
Another point that seems to be overlooked in these discussions is that this bounty adds a new vector into the decision tree for the black hat. EvilBob now has to decide if that vulnerability he just found is worth more for his usual nefarious uses than the cash reward. In some cases, this might result in discoveries being reported for the reward instead of being used to attack the servers, converting the black hat over to white. I suspect the likelihood of this outcome increases exponentially with the size of the reward.
Bob McConnell