Why shouldn't full-disclosure'd bugs be eligible for NN% of the reward? (looking for strong arguments against it)
-
-
Should there be any payment for silence?
- 8 more replies
New conversation -
-
-
The argument would be that if you make the same $ for dumping as bug on Twitter as a zero-day, there's little to no incentive for reporters to engage in coordinated disclosure.
-
I should say "some reporters". There have always been those who would coordinate just because it feels right to them, but I think VRP's in part are to help incentivize people who don't have the time or inclination.
- 3 more replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.