Jonas L

An email sent out to researchers with vulnerabilities in these classes state that any ongoing research has to be submitted within 24 hours to be eligible, but gives researchers 7 days to provide additional details to reports submitted within those 24 hours.

I wonder if this will increase the number of Windows LPE zero days being dropped? Also what about programs such as @thezdi?

Thoughts? @jonasLyk @galdeleon @tiraniddo @SandboxBear @itm4n

I think it is embarrassing and sends a signal that Windows is so insecure paying bounties would ruin Microsoft. I am also very sad I have to give up on my dream profession as a bounty hunter. It was already economically almost impossible due to slow responses, slow patches.

Well I've no idea why they've stopped, I'd like to believe it's some new mitigation coming and they're being nice. Still I'm not sure it send any sort of signal, bug bounties shouldn't be a proxy for security. I'm sure @k8em0 could no doubt make the point better than me :-)

I feel the same about .Net Bounties only applying to beta versions and release candidates in .Net Core. No bounties for current release or .Net even when there's no current beta or release candidate. At least as far as I understand. Seems odd to me.

I did not know that... then I guess that invalidates a submission :(