Login
You're viewing the discuss.systems public feed.
  • Cure53🔓cure53@infosec.exchange
    Jun 22, 2025, 11:48 AM

    @jwildeboer @morre What about tying the bug bounty amount to the completeness of the bug report?

    If the fix is included and all tests are still green, the finder gets the full amount.

    If there was an attempted fix but the tests failed, the finder and maintainer would share the bounty.

    No fix at all? The maintainer gets the majority of the bounty.

    Needless to say, there is a lot of fine print to consider. Also, this method might be exploitable, so it needs strong committee oversight and competent handling. However, it might be a good starting point.

    💬 1🔄 0⭐ 0

Replies

  • daniel:// stenberg://bagder@mastodon.social
    Jun 22, 2025, 12:24 PM

    @cure53 @jwildeboer @morre IMHO creating the fix is not the big chunk of the work for a bounty program. It is all the assessing, researching, understanding and back and forthing before the issue is confirmed and verified etc. Once that is done, the fix itself is often quite straight forward.

    💬 2🔄 1⭐ 0
  • 💬 1🔄 0⭐ 0
  • Cure53🔓cure53@infosec.exchange
    Jun 23, 2025, 10:41 AM

    @bagder True, we are lucky with our - in that regard - niche software because either the JavaScript alert pops or it doesn't, and if it doesn't, well - likely no bug.

    But in other projects, that phase certainly demands for way more time than the actual fix/patch itself.

    Likely complicated to address without aforementioned committee or any other competent entity accompanying the whole triaging process.

    💬 0🔄 0⭐ 0
  • Morremorre@chaos.social
    Jun 22, 2025, 12:29 PM

    @bagder @cure53 @jwildeboer that’s a very good point.

    For the software I maintain, I’d estimate that about 10% of time is writing the fix, while probably about 80% is understanding the issue - which mostly tells me what the fix is.

    Is this Pareto at work again?

    💬 0🔄 0⭐ 0