Hacker News Reader

Comment by h43z | Hacker News Reader

So basically google wanted to give this guy nothing. Then he set a hard deadline for disclosure and google managed to buy him for 70k so they could stick with their own deadline.

View on HN

It would not surprise me if in some cases, google runs the exploit up the tree to the NSA to see if they're actively using this for matters of national security, then slow-walk the patch to release. Given how easy the exploit is (no software needed, no special equipment beyond a paper-clip), would not surprise me if this has been in wide use for several years now by various groups.

Or maybe not? https://www.technologyreview.com/2021/03/26/1021318/google-s...

I agree that it appears to have been the disclosure threat that resulted in the bounty, but I don't agree (if I'm reading you correctly) that the OP acted unethically. It sounds credible to me that he was just doing everything he could to get the bug fixed.

According to the article, the reporter had already decided before the bounty had been set that they would wait for the fix:

> I also decided (even before the bounty) that I am too scared to actually put out the live bug and since the fix was less than a month away, it was not really worth it anyway.

According to the bug thread transcript Google have not yet known he's not going to disclose in October when they offered the 70k.

https://feed.bugs.xdavidhu.me/bugs/0016

Or more charitably, by the terms of the program he wasn't eligable for anything, but they gave him seventy thousand dollars out of goodwill and the spirit of the program.

Then they would have done this before the sorta-threat of his own disclosure date.

Reply on news.ycombinator.com