Speaking of being sue, I once found a hole in a healthcare system. I solicited legal advice and the response was overwhelmingly against reporting. The company didn’t not have a bounty program. So I shut up knowing my info is sitting there exposed. I wonder what’s the consensus on this? Do people normally report it or not?

On some forms I was advised to report hippa complaint. I can’t remember if I did. This was 10 or more years ago.

Also he's 16. I'd definitely be less willing to push back (especially on something like this) at his age

Not getting your life ruined by getting sued by a trillion dollar company sounds like a pretty good motivation

i think the answer is simple: they're a kid, and microsoft bullied them.

Would love to hear more.

This is correct. I've made well over six figures over the last couple of years through bug bounty programs. I wouldn't spend months finding one bug. It's usually days or a week or two max.

$5,000 is actually pretty normal for a critical. I think the most I received for one bug was around $10,000, but this is the exception.

AI has also ruined the market. I'm a security consultant (where I make most of my money) and stopped bug bounty once AI slop reports made it impossible to actually get anything triaged in a timely manner.

Something else many don't know is that with all of the major platforms, customers can see the bugs before they are even triaged by the platform team. Many companies are now taking advantage of the long triage times and fixing the bugs before the researcher can get paid. It's then marked as a duplicate and the researcher gets nothing.

Try 10-20 million USD for a zero click iPhone exploit.

thats the true market value of bug bounty awards

the unilaterally set awards by the affected corporation are far lower and based on the price of the researcher’s liability

"all he did was scrape PDFs for mostly public funded / tax funded papers"

He wasn't a security researcher. He broke into a room and used equipment to steal information. It wasn't just 'tax funded papers'. Companies invested millions of dollars into some of this research.

We shouldn't support theft and he should have gotten some jail time/punishment for it.

"There should really be laws for protecting security researchers who produce 0 harm and divulge / share a vulnerability with a service provider. I'd rather the floor be getting no money AND not going to jail or being sued."

Too many 'security researchers' demand money or threaten to release the vulnerabilities.

I don't know anyone that got into trouble going through a legit bug bounty program.

Per their market cap...

3.85 billion is actually closer to a "penny" for Microsoft.

His comment didn’t assume that at all.

Physical security vendors usually stop exactly there. I can't count how many vendors responsible for badge systems shut off the Windows Firewall just because it’s easier than adding a rule.

Honestly that series of blog posts that came across here semi-recently about what an utter disaster the Azure team is (through little fault of their own, mind you), combined with a lot of things I've read about the development behind Halo Infinite, have convinced me Microsoft is to avoided whenever possible. It's not even that they're too big to care, though that is an issue. It's that organizationally they are SO reliant on short-term contractors and junior devs plugging away with copilot, along with an ever more exhausted group of seniors who actually work for them but are continually disempowered, that I think it's safe to say anything they manage to ship is a minor miracle if it works at all, and it's certainly not going to have any guarantee at all of solid software engineering fundamentals.

And to be clear, this is not an issue with them using contractors, overseas or otherwise, or with their senior dev staff, or even with AI really. It's an issue with them organizationally being so incredibly penny-pinching, and so dedicated to shipping new shit versus fixing anything long term, constantly chasing new revenue and letting their existing offerings rot.

If a Microsoft product is good nowadays, it is literally a miracle.

You assume there is any actual reason to care more than that in this case.

And all of that is definitely happening.

That being said, just last night I observed that the identity team is now opening up agent-assisted PRs against individual service team repos to force MISE adoption and upgrade to the latest version and best practices. I think that's a great thing because many individual service teams simply lack the bandwidth or knowledge. Prior to GenAI availability I wasted many cycles on this kind of work. While GenAI made it easier - internal source documentation still does not unambiguously address every use case. So having the identity team drive this now with the help of agent sessions initiated by them is great.