On Mon, Nov 26, 2012 at 7:17 AM, Michal Zalewski <[email protected]> wrote: >> His question seemed pretty clear to me. As indicated in the article he >> linked to, Google apparently raised their bounty/reward. He's asking if >> something happened to one of their products to cause that, or if they're >> just paranoid (and maybe expecting something to happen to one of their >> products). > > FWIW, these choices seem weird... for any announcement of that sort, > it seems more rational to assume any of the following: > > 1) It's getting harder to find bugs. Reward amounts correspond to the > average time needed to locate a vuln. > > 2) More reward programs are competing for a fixed pool of skilled > researchers. Reward amounts are just "bids" for their time. > > 3) Incoming reports are surprisingly good. Reward amounts are set to > recognize high quality work. > > 4) The vendor thinks that their product is bulletproof, and uses > increasing reward amounts as a publicity stunt. > > As far as I know, all reward increases for Google VRPs were driven by > a combination of factors 1 through 3.
Please stop ridiculling conspiracy theories with reasonable arguments :). No fun. > I am not sure how "being paranoid" factors in - complex products have > bugs, browsers doubly so. Similarly, malware seems like a weird reason > to bump up rewards. > > /mz > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ -- Robert Święcki _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
