Thread by @k8em0

Excellent post re hunting #bugbounties . These stats show the researcher's persistence & skilling up, & also inadvertently highlights problems w the #bugbounty ecosystem. What other security job only pays for 57% of your work?
"13% reward rate for 1st month, then 25%, then 57%."

External Tweet loading...
If nothing shows, it may have been deleted
by @eur0pa_ view original on Twitter

I'm a fan of creating incentives. What #bugbounties have turned into is a misinformed (on both hunted & hunter sides) replacement for other security activities. Thoughtful incentives (including but not limited to bounties) creates win-win. The 1st MS bounties had no duplicates.

I love that bug hunters & orgs running bug bounties are using the programs to learn. That's great news. But is it improving security over time, or just outsourcing QA, encouraging sloppier releases & deployments, which lead to more low-hanging fruit, & therefore more duplicates?

Important note: bug bounties were never meant to pay for work going into finding the bug. That would effectively make #bugbounties a violation of labor laws. They were supposed to be a means for hackers to earn $ & be able to disclose when fixed, instead of choosing $ for silence

$ for the bug+silence is a tool of offense markets for bugs & exploits, hence the much higher prices. #bugbounty $ for silence isn't worth the hunter's effort. NDAs are for pen tests & guaranteed fairly pre-agreed $ for labor. NDAs for the unsure labor of bounties is a bad deal.

The *original* MS bounties, even for the $100,000 mitigation bypass bounty, deliberately were created with no NDA, & no ownership of the IP (just a license to use it). I wanted no impediment to a hunter coming forward. I know that's changed now, after my departure.