Hacker News Reader

Comment by zrm | Hacker News Reader

> Having a financial incentive to mess up AMD might explain why they only gave 24 hours' warning, though.

A good way for companies to prevent this is to have a generous bug bounty program. Money is still transferred from the shareholders to the researchers, but then the company can impose conditions like delaying public disclosure for a reasonable time to prepare a fix.

View on HN

If it's actually someone attempting to make money on a short or to benefit from a working relationship with a competitor, then a bug bounty program does nothing. No one can run a bounty program that pays out anywhere near as much as the information is actually worth to an adversary. Bug bounties work to engender a bit of good will among researchers and to provide some incentive to an otherwise neutral party to play ball. They don't mean shit to a hedge fund or a competitor in a multi-billion dollar industry.

Not unless the bounties are large enough to attract the attention of a hedge fund.

> Not unless the bounties are large enough to attract the attention of a hedge fund.

Which they should be if the alternative is a much larger loss to the company's share value. The shareholders come out ahead to pay five million on a bug bounty if the alternative is to lose a billion dollars in market cap.

I'm not a finance expert, but my very lay person understanding of how financial markets work tells me that those would have to be some rather huge bounties. See e.g., the effect on Intel from earlier this year:

https://qz.com/1171391/the-intel-intc-meltdown-bug-is-hittin...

Reply on news.ycombinator.com