Jonas L

I can only accept it as a fact that my successful Pwn2Own participation attracted scrutiny to certain arguable and potentially outdated points in the contest rules. In the real world there is no such thing as an “arguable point”. An exploit either breaks the target system or not

By the way, the Microsoft Bug Bounty program used to have a similar point in the rules: to factor in whatever *private and internal* knowledge of an 0day bug to the vendor. Guess it raised similar concerns as it was quietly removed later. A solid precedent to think about it

The WIP bounty removed the overlap exclusion for collisions with internal cases. Since finders can’t know what’s already been found, the exclusion did nothing to positively shape behavior.

Quite the opposite: it caused finders to submit partial reports and then follow up with details to maximize their chance of being first, rather than waiting until they had an understanding of the bug and could help us meaningfully judge impact and root cause.

The current WIP rules are a lot more fair and transparent. And everyone gets a better outcome.