Slashdot Mirror
Microsoft Hands Out $28k In IE11 Bug Bounty Program
hypnosec writes "Microsoft paid out over $28,000 in rewards under its first ever bug-bounty program that went on for a month during the preview release of Internet Explorer 11 (IE11). The preview bug bounty program started on June 26 and went on till July 26 with Microsoft revealing at the time that it will pay out a maximum of $11,000 for each IE 11 vulnerability that was reported. Microsoft paid out the $28k to a total of six researchers for reporting 15 different bugs. According to Microsoft's 'honor roll' page, they paid $9,400 to James Forshaw of Context Security for pointing out design level vulnerabilities in IE11 as well as four IE11 flaws. Independent researcher Masato Kinugawa was paid $2,200 for reporting two bugs. Jose Antonio Vazquez Gonzalez of Yenteasy Security Research walked off with $5,500 for reporting five bugs while Google engineers Ivan Fratric and Fermin J. Serna were each handed out $1,100 and $500 respectively."
So they spend millions in developing the IE, including reviews, QA, etc. and they pay such miserable money for bug locating/fixing? Come on.
http://www.w3counter.com/trends
http://gs.statcounter.com/
http://marketshare.hitslink.com/browser-market-share.aspx?qprid=1&qpcustomb=0
There is an unexplained trend upwards in Internet Explorer
They only were offering bounties for two particular things in Windows: Internet Explorer 11 and the new anti-exploit mitigations in Windows 8.1. Even though there are plenty of other security targets in Windows, only those two things would get you money.
I found a bug in Windows's Secure Boot code that I'm using to jailbreak Windows RT. I might as well; it's not like they pay bug bounties for Secure Boot exploits.
The exploit could be used to run Android on Surface RT with a kexec-like driver implementation, but this would be a huge amount of work for someone who doesn't know Linux internals.
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
And they receive how much money from the NSA for providing them with details of zero-day exploits?
Are they still providing NSA with zero day exploits BTW? I assume the answer is yes.
It's more likely that the NSA pays VUPEN rather than Microsoft. Paying Microsoft directly would have blowback.
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
Microsoft:
3 months ending 2013-06-30:
Revenue: 19.896 Billion USD
Cost of goods/revenue sold: 5.602 Billion USD
Gross Profit: 14.294 Billion USD
Source:
https://www.google.com/finance?q=NASDAQ:MSFT&fstype=ii&ei=wcBTUtihB8z2qQHI8AE
Out of their costs of goods sold, these researchers got 0.00049982%.
Me thinks their contribution to M$ is more than a few 10,000ths of 1%. They did what the 5.6 billion spent on internal people failed to do. And M$ doesn't have to pay their healthcare.
The cost of the meeting (hourly pay, room, overhead, etc.) for a bunch of execs at Microsoft to figure out how little to give these guys most likely cost more than 28,000 USD.
One can't help but to note that they gave the Google employees just enough to pay for dinner in downtown Palo Alto.
...the crowd here hate anything MS...
If your answer includes "Microsoft is Hated" as a reason for anything you are right to not register here. Ignoring the fact that you sound like a sulky 16 year old girl. The mix here is far from being Linux and Apple centric. Microsoft is an abusive, customer hostile company that deserves to be hated. The reality is it isn't. People are fickle, and right now Microsoft is one disappointment after another...but that would not stop them using IE. If it wants to be loved, producing decent products would be a good start.
The answer is unlikely to be a new version of IE (one over a year old and one unrealsed)..."better" is just another unmeasurable "meh" it does not cut it here, or anywhere. It is still vastly behind, platform centric option. If IE10 was any good (IE11 not yet released) it would have started making traction 13 months ago...not now.
It's unlikely to be cash, but gee, contracts. Big fat NSA surveillance equipment contracts. I can well believe those are the reward for the 0-day exploits.
I'm reminded of QWEST CEO, the only telco to resists the NSA illegal demands... and was prosecuted for insider trading and suspects it was reprisal.
https://www.techdirt.com/articles/20130927/14413024680/one-telco-exec-who-resisted-nsa-has-been-released-4-years-jail.shtml
However, one of the things he mentions is that as soon as he resisted the NSA's demands, a big NSA contract with QWEST was cancelled (as presumed punishment).
So it's not pocket change they're playing for here, it will be millions/ potentially billions of Microsoft revenue at stake for not playing along with NSA's power grab.
trends to visibly change around the release date of a browser is naive at best.
That is not what I said. My point is that if a better(sic) browser was the reason for the years of Internet Explorer market decrease ironically despite vastly better browsers on the market, but it to happen it happen thirteen months after launch is inconceivable...people do not suddenly start getting old products without some catalyst for change, as even you claim the launch of the new version wasn't one(You go further claiming it couldn't be)
The bottom line is the catalyst for change is somewhere else. I suspect that Internet Explorer sudden change of fortune, is a side effect of another change.
can't even watch a fucking youtube video...chrome and ie for the win.
Ironically changes come at the expense of Chrome. Ignoring the fact that most users manage quite nicely to play videos on youtube, and it is unlikely that Google would not ensure that Firefox works well with youtube. Youtube has a HTML5 trial http://www.youtube.com/html5 , and it works great. In other news the firefox team is working towards a Flash replacement "Shumway" http://www.areweflashyet.com/shumway/
It looks like youtube is a reason for using Firefox not against, As for your hardware flash is fast enough to run on anything but an iPhone ;)
Heh. The sad thing is that if you swap the names Google or Apple into that statement (or any of a number of other obvious names), it would hold just about as much truth.
Except its not even remotely true. Google move from strength to strength, and Apple are immune to criticism. Microsoft is surrounded by failure both in its traditional "monopoly" market windows and its new markets "products and services". Ballmer got stabbed in the front by Bill "my charity is better than yours" Gates "I don't have to pay tax". Its Xbone launch was anti-gamer.
Want Proof....http://www.interbrand.com/en/best-global-brands/2013/Best-Global-Brands-2013.aspx Apple is considered the top brand...Google the top riser.(Microsoft did rise a smigin though ;)
observed Linux zealots and so-called "advocates" lying, spreading FUD
http://en.wikipedia.org/wiki/Criticism_of_Microsoft list of criticisms, heavily documented.
That's what you get when management shit-for-brains get to decide what buzzwords are relevant in a job application. Framework familiarity > actual skills. Coincidentally the reason I left teh biz.
http://html5test.com/results/desktop.html
Chrome score 463
Firefox score 414
Internet Explorer 10 scores 320(Internet explorer 8 XP users trapped on scores 42)
http://www.tomshardware.com/reviews/chrome-27-firefox-21-opera-next,3534-12.html which benchmarks the various browsers extensively gives
Firefox score 326
Chrome score of 326
Internet Explorer 182
That is a LOT of bug detectors who got 1 dollar from MS.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.