... which is why the rest of us should give them, and those who operate them, zero respect.
Nobody but AMD gives a fuck about AMD's internal policies or motivations.
Nobody but AMD gives a fuck about AMD's internal policies or motivations.
If you don't care about AMD, why are you white-knighting AMD and defending AMD's bad behavior?
But, hey, OK, let's not make it about AMD specifically. It doesn't matter what any company thinks the purpose of its program is, nor does it matter what scope any company unilaterally decides to set for its program. What the outside world is going to see is whether or not you ignore security bugs. Your weird arcane internal policies, justifcations, and "scopes" are irrelevant. And, although I don't honestly care much about "security researchers", you can't really expect them to keep track of your private set of scope rules either... assuming you even tried to tell them the rules in advance to begin with.
My motivation here is very simple: I think people dunking on AMD's bounty program here mostly don't understand how bug bounties function. You apparently keep track of my comments on HN, so I think you know that's a beat I have here.