<story><title>Announcing the Windows Bounty Program</title><url>https://blogs.technet.microsoft.com/msrc/2017/07/26/announcing-the-windows-bounty-program/</url></story><parent_chain></parent_chain><comment><author>tiffanyh</author><text>I wonder what impact this will have on open source software (OSS).&lt;p&gt;OSS can&amp;#x27;t afford to pay people to look for bugs and improve the overall software. But commercial companies can.&lt;p&gt;I wonder if there will exist a date&amp;#x2F;time in the future where closed-source software, because of these bug bounties, will yield better (less buggy) software vs OSS.</text></comment>
<story><title>Announcing the Windows Bounty Program</title><url>https://blogs.technet.microsoft.com/msrc/2017/07/26/announcing-the-windows-bounty-program/</url></story><parent_chain></parent_chain><comment><author>strictnein</author><text> &amp;gt; If a researcher reports a qualifying vulnerability already found internally by Microsoft, a payment will be made to the first finder at a maximum of 10% of the highest amount they could’ve received (example: $1,500 for a RCE in Edge, $25,000 for RCE in Hyper-V)&lt;p&gt;Wow. I guess this kind of functions as hush money? To make sure they don&amp;#x27;t reveal the issue before MS patches it. But still, this seems like a good move.</text></comment>