Pre-flood, they didn’t pay more did they?
reply> viewed it as insurance
Of course. Beyond the ethics, the social obligation, sleeping well at night by compensating hardworking people fairly.
“We can’t pay more or we’d have to hire more human reviewers” should never be a massive company’s line of thinking.
They should just multiply a base rate against the severity level. Say the base rate is ranged so low-severity stuff is $500-1K base but high-severity stuff is $10K base. That would net a researcher ~$88K for this specific bug (8.8 severity).
replyThat would create a perverse incentive to inflate the severity levels even more than they already are
replyCVE severity is a terrible way to do this. If you follow the cybersecurity space you should know why.
replyit's such a drop in the bucket, it wouldn't make any difference
reply