Hacker News Reader

>Google should payout on the total impact of the bug that they measure

And what is that total impact?

As said: only Google has the resources and motivation to measure the potential impact. David already identified a few places the bug might affect:

“I found this regex in the Google Cloud Console’s JS, Google Actions Console’s JS, in YouTube Studio, in myaccount.google.com (!) and even in some Google Android Apps. A day later I even found this line in the Google Corp Login Page (login.corp.google.com)”.

>only Google has the resources and motivation to measure the potential impact.

And apparently they have judged the impact less than folks who think $6000 is too small.

They may have decided, for example, that the majority of cases were not security related. If they were just cosmetic or something...

One way to estimate it is to ask how much that bug would've sold for on the black market.

That'd definitely be more than USD 6k.

Who would the buyer be and how much would they pay?

Reply on news.ycombinator.com