Slashdot Mirror
Google Says No More Cash For Trash Web Bugs
Trailrunner7 writes "It's bound to happen: you create a cool, forward looking incentive program designed to tap the 'wisdom of the crowd' and help make your products better, only to find out that, in fact, the 'crowd' isn't all that wise — and now wants you to pay cold, hard cash for their tepid ideas. That's the experience that Google appears to have had since announcing that it would extend its bounty program for bugs from its Chromium platform to the various Web applications that the company owns. In an updated blog post this week, the company said it has already committed to some $20,000 in bounties, but also provided some 'clarification' to the terms of the reward program, saying that — in essence — not all bugs are equal and that researchers dumping low priority vulnerabilities shouldn't expect to get much in return. 'The review committee has been somewhat generous this first week,' wrote Google's Security Team in a blog post. 'We've granted a number of awards for bugs of low severity, or that wouldn't normally fall under the conditions we originally described.'"
I hate to be the guy who complains about the headline of a story... but a "web bug" is an image in a web page or HTML email that allows the site owner to track who has visited the page or read the email. This story has absolutely nothing to do with "web bugs". How about "browser bug" instead?
This sig is umop apisdn.
haha disregard that i suck cocks
you got a lot of bugs in your apps fixed with just $20,000, and in one week, and you are bitching about it. its just $80k/month, at this state.
every one of those low priority bugs could be driving off a user or a customer at this point, had they not been fixed.
Read radical news here
Not so much ideas, as professional work. If you post bounties like this, people will send in whatever bugs they can scour out in hopes of getting paid. That means it's working. Think of it like this, how much do you think a closed-source security review on this scale would have cost?
Emotions! In your brain!
Google paid out for those poor results, too; and then said they're not doing that anymore. They stood by their offer; however they've decided to modify the terms going forward. Retroactive modification is irritating; otherwise it's just every day life.
Support my political activism on Patreon.
A private exploit for a mass-market browser is an incentive in and of itself.
Emotions! In your brain!
It looks like they are starting to get the idea that a lot of people who talk about "crowdsourcing" have yet to understand: quantity != quality. We know that in so many other places; so why do people fail to recognize this fact in crowdsourcing?
The best ideas are likely to be uncommon not common. If you're looking for something valuable, you don't want the thing that is most popular on first glance. You want the thing that can really win everyone over in the long run. That's the principle behind collaborative governance, which again, is horribly misunderstood as some sort of mob rule thing.
Even Slashdot knows better than to just give everyone a vote on everything. They have limited moderation, and then meta-moderation as a secondary check. And even that is rather primitive compared to the collaborative governance stuff.
I am altering the deal. Pray I don't alter it any further.
- Darth Google (not evil)
Gamingmuseum.com: Give your 3D accelerator a rest.
>some $20,000 in bounties
Wow problems paying out 20,000$ for doing your job for you, and actually still catching some bugs,
yet your shares are still climbing steadily....I thought google would have been a little more supportive of the dev community trying to help them out, especially seeing as most google employees have the 6 cars in the driveway and are not really strapped for cash.
Google is merely stating from this point onward, they're going to scrutinize the severity of the bugs reported before paying out. If people aren't willing to accept that their bugs might get them nothing, they don't need to get involved.
Wait, this seems like bullshit to me.
Because Google doesn't rank the exploit as high priority, it's "poor" all of a sudden?
You drank the fucking Kool-aid buddy.
It's better than taking it and going, "Oh, thanks. Well, this is nice and I'll keep it but it's really not so good, so I think I'll just send you on your way." They took stuff, they paid, and they told everyone else "well we didn't think this out completely, so let's not do that anymore."
Support my political activism on Patreon.
to the individual responsible: present yourself to me; admit what you've done and i will bring upon you the ultimate punishment for your transgressions.
why do you cower in the shadows of others? are you unwilling or unable to be your own person?
you're completely pathetic.
"MichaelKristopeit172" is operated by a pathetic individual attempting to steal my identity.
to the individual responsible: i assume you welcome death. present yourself to me; admit what you've done, then i will bring upon you the ultimate punishment for your transgressions.
are you unwilling or unable to be your own person?
Surely you jest. With 150+ MichaelKristopeit accounts you are unable to be your own people. MK Fail. Pathetic.
i assume you welcome death.
Another death threat? Don't you have anything new in your copy and paste library?
I think the point is that Google is deciding arbitrarily what is a high and low priority bug.
What incentive do you have to spend time researching Chrome bugs and sending them your findings, if they will turn around and say "Oh, this bug isn't really that important to us, so we're not going to pay.
Aside from that what were they paying for each bug, something like $200 on up? Not a huge amount of cash for Google to be throwing around there.
you spend your days pretending to be me. i spend my days actually being me. do you NEED to be me, OR do you simply NEED to NOT BE YOURSELF?
you are NOTHING.
"MichaelKristopeit172" is operated by a pathetic individual attempting to steal my identity.
to the individual responsible: i assume you welcome death. present yourself to me; admit what you've done, then i will bring upon you the ultimate punishment for your transgressions.
We are mocking you. No one wants to be you. Not even you. Not even the 150+ MichaelKristopeit accounts. Mocking != Being. Pathetic.
"MichaelKristopeit175" is operated by a pathetic individual attempting to steal my identity.
to the individual responsible: i assume you welcome death. present yourself to me; admit what you've done, then i'll bring upon you the ultimate punishment for your transgressions.