them: "bug bounty is a scam" their reports:pic.twitter.com/4zT4ibAR8D
-
Alternative storyline: Them: https://docs.google.com/document/d/1sRrftambp4gz4koVX1Qs1l1ODDFTp1eUd6j6NvmCt1U/edit#heading=h.ca82rsk4z7q2 … Not them: Yarh we spent over one year completely rewriting group policy service- so every vulnerability submitted in that period we just stashed untill now we deployed the new design. Do your exploit still work with new design?
ummm no- of course it do not how could i find vulnerability in code ive never seen? Oh well- by law then its a duplicate of the submission that triggered the rewrite - even though only thing in common is that it is in the same service. But thank you for the two other vulns :)
-
-
You do of course not get a dollar for them as without the last vulnerability in your chain no security boundaries are broken. But we can now see how they can be used together with other vulns and can prioritize the fixes accordingly
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.