Slashdot Mirror
Mega Vulnerability Reward Program Starts Payouts: 7 Bugs Fixed In First Week
An anonymous reader writes "If you're a hacker or a security researcher, this is a reminder that you don't have to take on Google's or Mozilla's software to get paid for finding a bug. In its first week, the Mega vulnerability reward program has already confirmed and fixed seven bugs, showing that Dotcom really does put his money where his mouth is. Although Mega hasn't shared how much money it paid out in the first week, how many bug submissions were made, or even who found which bugs, the company did briefly detail the discovered security holes. It also confirmed that the program is here to stay and urged those participating to find more severe bugs."
Lets hope it helps keeps those annoying federal police out of your servers.
I'm not signing anything
1. Pay unskilled programmers little money to quickly turn out software.
2. Release software you know is completely buggy and insecure.
3. Offer bounty for better programmers to find bugs at overall cheaper rate.
Kim Dotcom might pay well, but I'm sure he knows as well as anyone else that crime is where the money is
Certainly right. There's probably even huge amounts of money to be made by suing USDOJ trolls for slander.
The people who search for exploits to offer them for sale are not necessarily the same ones these campaigns are targeted at.
It's disappointing that software makers seem to only ever offer bounties for security bugs, rather than for all types of bugs and for ideas to improve the software. Don't worry if the software is a POS to use — no-one can misuse it!
Bounties for ideas and general fixes are feasible if contributors must agree that the company takes ownership of any submitted ideas, and that no compensation should be expected. Payments are totally at the company's discretion. This should cover the legal worries that currently make such payments very rare.
At the same time a company would be smart to provide monetary rewards that acknowledge suggestions that have clearly benefited the company. It's good business, and good PR.
What great news, And there are competitions sponsored by China, Iran and North Korea to find bugs like this too.
I'm an American. I love this country and the freedoms that we used to have.
That's a bit dumb, really. You're implying that if no legitimate people offered rewards, then the illegitimate hackers would stop doing their thing? That's equivalent to saying that if the police didn't offer "Crime Stopper" rewards, then the crooks would stop committing crimes. It makes no sense at all.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
I think his point was more that it's sad that rewards have to figure into this at all, since some (not all) of the people claiming the rewards might be amoral and simply go for the highest bidder. A little like paying pickpockets not to rob people, y'know?
Bio questions? Ask me to start a Q&A journal. Computer analogies available for most topics!
Fuck man! Can you stop spamming from religious texts for a while?
I'd argue that this is more like paying a pick pocket to teach you how to stop other pick pockets from targeting you.
If you involve teaching in the analogy you have to make it symmetrical, at which point it's no longer an analogy at all: you're paying people who teach pickpockets to teach you instead of them. Doesn't really have the original ring to it, y'know? The important part is "paying bad people not to do bad things for profit."
Bio questions? Ask me to start a Q&A journal. Computer analogies available for most topics!
Not necessarily a shill. But definitely a christian. Christians can't tell right from wrong, so you just assume legal == right.