Hacker News Reader

Comment by reese_john | Hacker News Reader

  > August 17 2021 - MSRC awarded $40,000 bounty for the report.

I don't know much about the bug bounty industry, is this the typical payout from what it seems to be a pretty severe vulnerability?

View on HN

The part that's contraversial about the MS bounties is that they stopped covering the majority of on-premise products.

For example, person that reported the two major Microsoft Exchange vulnerability chains received no payout at all.

Ref: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-ProxyL...

MS is pretty bad about vulnerability bounties. I reported one about privilege escalation on WSL1 and received no response plus it was patched within the following months. Was a bit aggravated.

Truly horrible, despite tooting their horn about it a very awful lot.

Yes. A competent researcher deciding to investigate their products can reasonably be expected to find a new, unique vulnerability of this severity given a few weeks to maybe a month of effort. At a standard consulting rate that amounts to a few thousand to low tens of thousands of dollars, so a $40,000 payout is a fair amount for the amount of effort and difficulty to find a bug that totally invalidates the security of a major service by a top, world class cloud provider.

Not a great comparison. A researcher does not work for a company, a researcher is basically a mercenary; they'll go where the money is. If a company pays too little relative to its peers, or fails to pay out too often due to fine-print in the T&Cs, researchers will go elsewhere. That's a serious loss for Microsoft given the kinds of vulnerabilities and their impact that a researcher can find if they're focusing on your platform.

I believe the last sentence in the parent comment was (top notch) sarcasm.

Yes, quite large. Next HN will say how many billions they could afford to pay because of all the potential damage. If it's hard to make sense, the security guard at the bank doesn't get paid a % of the money if they stop a robbery and many other examples off payout being way less than potential damage caused.

That's a bad faith comparison, and I don't really see the relation between the two.

Reply on news.ycombinator.com