<story><title>Microsoft Offers Bug Bounty to Prevent Another Spectre-Meltdown Fiasco</title><url>https://hothardware.com/news/microsoft-offering-up-to-250000-in-speculative-execution-bug-bounty-program</url></story><parent_chain></parent_chain><comment><author>WebLLL</author><text>The offer is limit to bugs that are not already known to Microsoft or their partners, and they are not disclosing what these bugs are, and they are making no claim to have fixed them. I made a submission to Intel and others weeks after some were claiming to have mitigated this with small reductions in timer resolution, showing that the timer mitigation would not stop these vulnerabilities, no one would pay out, said they were already aware of it, have they informed the public, have they withdrawn their product, have their transitioned their user base to safer products??? No one is going to hand over their well documented exploits under such terms. Let them offer twice the reward for public disclosures of issues that they already know and have not fixed or not warned the public about, and then we might take their offer seriously.</text></comment>
<story><title>Microsoft Offers Bug Bounty to Prevent Another Spectre-Meltdown Fiasco</title><url>https://hothardware.com/news/microsoft-offering-up-to-250000-in-speculative-execution-bug-bounty-program</url></story><parent_chain></parent_chain><comment><author>mastax</author><text>Bug bounties are good but they wouldn&amp;#x27;t have prevented Spectre-Meltdown. The only way to prevent such a fiasco is for the bugs to never exist in the first place. The only difference bounties make is that hopefully vendors patch the issue before it becomes widely exploited. In the case of S&amp;#x2F;M, vendors got many months of notice and it was still a fiasco - that is the nature of software bugs.</text></comment>