Slashdot Mirror
Google Says No More Cash For Trash Web Bugs
Trailrunner7 writes "It's bound to happen: you create a cool, forward looking incentive program designed to tap the 'wisdom of the crowd' and help make your products better, only to find out that, in fact, the 'crowd' isn't all that wise — and now wants you to pay cold, hard cash for their tepid ideas. That's the experience that Google appears to have had since announcing that it would extend its bounty program for bugs from its Chromium platform to the various Web applications that the company owns. In an updated blog post this week, the company said it has already committed to some $20,000 in bounties, but also provided some 'clarification' to the terms of the reward program, saying that — in essence — not all bugs are equal and that researchers dumping low priority vulnerabilities shouldn't expect to get much in return. 'The review committee has been somewhat generous this first week,' wrote Google's Security Team in a blog post. 'We've granted a number of awards for bugs of low severity, or that wouldn't normally fall under the conditions we originally described.'"
I hate to be the guy who complains about the headline of a story... but a "web bug" is an image in a web page or HTML email that allows the site owner to track who has visited the page or read the email. This story has absolutely nothing to do with "web bugs". How about "browser bug" instead?
This sig is umop apisdn.
haha disregard that i suck cocks
you got a lot of bugs in your apps fixed with just $20,000, and in one week, and you are bitching about it. its just $80k/month, at this state.
every one of those low priority bugs could be driving off a user or a customer at this point, had they not been fixed.
Read radical news here
Google is pulling another dick move here. Their bounty for bugs program provided an incentive for people to report the bugs to Google. Even though a bug may be "low priority" to Google, a researcher probably spent some pretty decent time finding and verifying the bug.
Maybe other parties will start offering bounties for Google bugs. Perhaps their intentions will be noble, and perhaps they are goin' fishin'...
Not so much ideas, as professional work. If you post bounties like this, people will send in whatever bugs they can scour out in hopes of getting paid. That means it's working. Think of it like this, how much do you think a closed-source security review on this scale would have cost?
Emotions! In your brain!
Google paid out for those poor results, too; and then said they're not doing that anymore. They stood by their offer; however they've decided to modify the terms going forward. Retroactive modification is irritating; otherwise it's just every day life.
Support my political activism on Patreon.
A private exploit for a mass-market browser is an incentive in and of itself.
Emotions! In your brain!
Relevant.
You must be new here.
It looks like they are starting to get the idea that a lot of people who talk about "crowdsourcing" have yet to understand: quantity != quality. We know that in so many other places; so why do people fail to recognize this fact in crowdsourcing?
The best ideas are likely to be uncommon not common. If you're looking for something valuable, you don't want the thing that is most popular on first glance. You want the thing that can really win everyone over in the long run. That's the principle behind collaborative governance, which again, is horribly misunderstood as some sort of mob rule thing.
Even Slashdot knows better than to just give everyone a vote on everything. They have limited moderation, and then meta-moderation as a secondary check. And even that is rather primitive compared to the collaborative governance stuff.
I am altering the deal. Pray I don't alter it any further.
- Darth Google (not evil)
Gamingmuseum.com: Give your 3D accelerator a rest.
>some $20,000 in bounties
Wow problems paying out 20,000$ for doing your job for you, and actually still catching some bugs,
yet your shares are still climbing steadily....I thought google would have been a little more supportive of the dev community trying to help them out, especially seeing as most google employees have the 6 cars in the driveway and are not really strapped for cash.
For a multi-billion dollar company that seems like a rather small investment. Perhaps Google should stop snivelling about people trying do them over for cash and actually do some bug testing themselves. They would spend a lot more than $20K if they did it all in house!
Google is merely stating from this point onward, they're going to scrutinize the severity of the bugs reported before paying out. If people aren't willing to accept that their bugs might get them nothing, they don't need to get involved.
Wait, this seems like bullshit to me.
Because Google doesn't rank the exploit as high priority, it's "poor" all of a sudden?
You drank the fucking Kool-aid buddy.
"anonymity is a tool only of the coward." - by MichaelKristopeit170 (1939490) on Friday November 12, @06:58PM (#34212170)
So is a BRAND NEW USER with no posting history before this, in yourself (and you're probably not going to be heard from again, or not much, from THIS VERY ACCOUNT ID YOU USE).
---
"why do you cower? what are you afraid of?" - by MichaelKristopeit170 (1939490) on Friday November 12, @06:58PM (#34212170)
NO cowering, but you ought to be "afraid" really: You're trackable as anything because you're a "registered 'luser'" here, because of that post history you have tracking you here... think about it.
Heh - then again though, you've obviously just created that 8 digit user ID /. registered account of yours just to troll others here in this thread... & I am not the only one here stating that they've noticed that about you here in this exchange either. See here -> http://it.slashdot.org/comments.pl?sid=1866182&cid=34212584
---
"are you attempting insult, feeb?" - by MichaelKristopeit170 (1939490) on Friday November 12, @06:58PM (#34212170)
No, you're the one tossing names & attempting ad hominem attacks + insults here (see your own words there and others I quoted above).
---
"you're completely pathetic." - by MichaelKristopeit170 (1939490) on Friday November 12, @06:58PM (#34212170)
Hmmm: Seems YOU'RE the one reduced to name tossing directed others' way here... not I.
Web bug? Google provides trash. When will they get a life?
It's better than taking it and going, "Oh, thanks. Well, this is nice and I'll keep it but it's really not so good, so I think I'll just send you on your way." They took stuff, they paid, and they told everyone else "well we didn't think this out completely, so let's not do that anymore."
Support my political activism on Patreon.
I think the point is that Google is deciding arbitrarily what is a high and low priority bug.
What incentive do you have to spend time researching Chrome bugs and sending them your findings, if they will turn around and say "Oh, this bug isn't really that important to us, so we're not going to pay.
Aside from that what were they paying for each bug, something like $200 on up? Not a huge amount of cash for Google to be throwing around there.