<commit_before>---
title: "Beyond Pwnium: Reducing time to bug disclosure"
layout: post
published: true
tags: disclosure
---

The Google Security Team [announced they are expanding the Pwnium competition](http://googleonlinesecurity.blogspot.co.uk/2015/02/pwnium-v-never-ending-pwnium.html) to be an all year virtual event instead of  1 day, in-person event at CanSecWest:

>Removing barriers to entry: At Pwnium competitions, a security researcher would need to have a bug chain in March, pre-register, have a physical presence at the competition location and hopefully get a good timeslot. Under the new scheme, security researchers can submit their bugs year-round through the Chrome Vulnerability Reward Program (VRP) whenever they find them.

>Removing the incentive for bug hoarding: If a security researcher was to discover a Pwnium-quality bug chain today, it’s highly likely that they would wait until the contest to report it to get a cash reward. This is a bad scenario for all parties. It’s bad for us because the bug doesn’t get fixed immediately and our users are left at risk. It’s bad for them as they run the real risk of a bug collision. By allowing security researchers to submit bugs all year-round, collisions are significantly less likely and security researchers aren’t duplicating their efforts on the same bugs.

>Our researchers want this: On top of all of these reasons, we asked our handful of participants if they wanted an option to report all year. They did, so we’re delivering.<commit_msg>Blog Post - Beyond Pwnium: Reducing time to bug disclosure<commit_after>---
title: Beyond Pwnium: Reducing time to bug disclosure
layout: post
published: true
tags: disclosure
date: 2015-02-24 23:02
---

The Google Security Team [announced they are expanding the Pwnium competition](http://googleonlinesecurity.blogspot.co.uk/2015/02/pwnium-v-never-ending-pwnium.html) to be an all year virtual event instead of  1 day, in-person event at CanSecWest:

>Removing barriers to entry: At Pwnium competitions, a security researcher would need to have a bug chain in March, pre-register, have a physical presence at the competition location and hopefully get a good timeslot. Under the new scheme, security researchers can submit their bugs year-round through the Chrome Vulnerability Reward Program (VRP) whenever they find them. 
>Removing the incentive for bug hoarding: If a security researcher was to discover a Pwnium-quality bug chain today, it’s highly likely that they would wait until the contest to report it to get a cash reward. This is a bad scenario for all parties. It’s bad for us because the bug doesn’t get fixed immediately and our users are left at risk. It’s bad for them as they run the real risk of a bug collision. By allowing security researchers to submit bugs all year-round, collisions are significantly less likely and security researchers aren’t duplicating their efforts on the same bugs.
>Our researchers want this: On top of all of these reasons, we asked our handful of participants if they wanted an option to report all year. They did, so we’re delivering.
{'fraction_non_alphanumeric': 0.047603731103248635, 'fraction_numerical': 0.008362817626246381, 'mean_word_length': 4.664845173041894, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 9, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2143170', 'n_tokens_mistral': 795, 'n_tokens_neox': 750, 'n_words': 468}