Facebook Offers $500 Bounty for Reporting Bugs: Why So Cheap? | Hacker News Reader

Facebook Offers $500 Bounty for Reporting Bugs: Why So Cheap?

pcmag.com

16 pointsbootload11 comments

Not for reporting bugs. For reporting security bugs.

Google also doesn't offer such bounties when merely reporting bugs. I report all kinds of Canvas issues to Chromium. Half of them aren't even acknowledged, even if they get fixed months later.

Google only gives bounties on security bugs, and as far as I know only significant ones (though we'll see, because I just reported an incredibly minor security bug to Chromium - getImageData in Canary is capable of getting image data from outside the Canvas, which is against spec and a security flaw)

Actually they give bounties on minor security bugs as well - the award depends on severity. A bug like you describe will most certainly get something (if Canary is an eligible target).

The total amount of these bounties are more or less meaningless. No one can make a living, 1st world wage with them - at least not consistently. All of the programs will pay you significantly less than what you'd get paid for an equivalent number of hours at a straight job.

What's more, most bugs will sell for 10x the bounty price on the black market.

Bug bounties aren't intended to be competitive compensation. They are intended to be tokens of appreciation given to people who would be reporting the bugs anyway. In this context, $500 vs. $1000 (a more typical reward from the chrome program) isn't too meaningful.

Whether this works for the researcher or not is up to them.

At best, a bounty program gives me the incentive to look more closely at a particular website / application. But I've submitted plenty of vulnerability reports to companies that don't have bounty programs.

What this bounty really means: if you like finding and responsibly reporting security vulnerabilities, you now have one more reason to spend time doing so on Facebook.

Why so cheap? Because $500 is the base, not the maximum. $500 is the base reward for Google and Mozilla's web bounty programs as well. Another similar bounty program, from CCBill, lists a maximum payout of $500 (although I can confirm that they can and will issue higher rewards under certain circumstances: https://twitter.com/#!/williamlbell/status/97379423816384512)

[Note: I've participated in the bounty programs for Google, Mozilla, and CCBill. I've submitted security vulnerabilities to Facebook as well prior to this bounty program]

Article is incorrect about Microsoft. They still offer $0. The 250k is a bounty on turning in criminal botnet owners.

"But a security researcher cited in ComputerWorld says reporting Facebook bugs can help budding security researchers make a name for themselves in the tight-knit security community."

"I can't pay you to make my website, but you can use it in your portfolio!" springs to mind

I found a bug on pcmag.com -- how much is their bounty?

Hey, at least they're way ahead of Donald Knuth.

Personally I'd rather have a check signed by Donald Knuth than a $500 bounty.

Which suggests a scheme where Knuth could be paid a one time fee of (say) $50k, then be asked to issue 0.02c cheques for each bug found.

Reply on news.ycombinator.com