<story><title>“Artery chokes after 70 copies of Visual Studio”</title><url>https://connect.microsoft.com/VisualStudio/feedback/details/812643/artery-chokes-after-70-copies-of-visual-studio</url></story><parent_chain><item><author>droopybuns</author><text>Repectfully, you are incorrect that bounties exist to make it more profitable to disclose than to sell.&lt;p&gt;Corporate bug bounties will never be able to compete with the budgets of nation states.&lt;p&gt;They are basically a way of paying respect for a moral approach to a discovery that takes great skill.</text></item><item><author>evan_</author><text>Bounties exist for security bugs to make it more profitable to report the bug than it is to exploit it, or to sell knowledge of it to those who would. A buy about opening 70 copies of Visual Studio is unlikely to be very profitable to exploit.</text></item><item><author>kohanz</author><text>Not that this is a major bug, but it makes me wonder why a bug report of this detailed nature (basically doing the debugging for Microsoft engineers) shouldn&amp;#x27;t be eligible for a bounty, just as exposed security flaws are.&lt;p&gt;For this bug, it would be a very small or non-existent bounty since this use case affects almost no one, but what if someone found a major bug that was not a security issue, and worked out the cause and fix, as was done in this case? Is that so much less valuable than a security issue?</text></item></parent_chain><comment><author>MichaelGG</author><text>Please tell me, what do I need to do to sell to nation states? I&amp;#x27;ve found lots of remotely-exploitable (as in root or direct financial gain) in open source and commercial software. Vendors have poor responses[1] so I&amp;#x27;ve stopped disclosing but if I could legally convert them into cash I&amp;#x27;d be very interested in knowing how. For now I&amp;#x27;m just keeping them because I might decide to open an auditing company some day and they&amp;#x27;d be good marketing.&lt;p&gt;1: Once a company got angry and blamed me for delaying their shipping cycle. Another time they laughed when I suggested their memory corruption might be leveraged for escalation. And another vendor told me &amp;quot;buffer overflows would only happen maybe if you had a very fast network IO&amp;quot;.</text></comment>
<story><title>“Artery chokes after 70 copies of Visual Studio”</title><url>https://connect.microsoft.com/VisualStudio/feedback/details/812643/artery-chokes-after-70-copies-of-visual-studio</url></story><parent_chain><item><author>droopybuns</author><text>Repectfully, you are incorrect that bounties exist to make it more profitable to disclose than to sell.&lt;p&gt;Corporate bug bounties will never be able to compete with the budgets of nation states.&lt;p&gt;They are basically a way of paying respect for a moral approach to a discovery that takes great skill.</text></item><item><author>evan_</author><text>Bounties exist for security bugs to make it more profitable to report the bug than it is to exploit it, or to sell knowledge of it to those who would. A buy about opening 70 copies of Visual Studio is unlikely to be very profitable to exploit.</text></item><item><author>kohanz</author><text>Not that this is a major bug, but it makes me wonder why a bug report of this detailed nature (basically doing the debugging for Microsoft engineers) shouldn&amp;#x27;t be eligible for a bounty, just as exposed security flaws are.&lt;p&gt;For this bug, it would be a very small or non-existent bounty since this use case affects almost no one, but what if someone found a major bug that was not a security issue, and worked out the cause and fix, as was done in this case? Is that so much less valuable than a security issue?</text></item></parent_chain><comment><author>sliverstorm</author><text>Of course they cannot compete on a dollars-for-dollars basis, but people will often accept less return (or pay more) to stay on the up-and-up.&lt;p&gt;If a criminal would pay you $10 for your exploit, and I would pay you $9 to disclose it- many people would opt to disclose.</text></comment>