And yet, it still seems out of line with the scope of the vulnerability.
"seems" implies a subjective measurement.
> If the researchers weren't ok with that bounty, they shouldn't (and wouldn't!)
Researchers are going to research. Please don't carry water for trillion dollar companies; the reward was paltry don't blame the researchers for Microsoft's cheapness.
It is only uninformed HN posters imagining that vulnerabilities are worth millions of dollars on some imaginary black market that are complaining about it. Just like they do with every vulnerability disclosure that mentions the size of the bounty.
And by repeating this low-value conversation for the hundredth tube, you (yes, the specific you) are just hijacking the conversation and taking attention from what is unique and interesting about this case into your fantasy grievances about the bounty being too small.
Well, good morning to you as well.
Anyway, the conversation had turned to the topic of remuneration. You didn't reply with THIS comment originally, you joined right in and defended Microsoft's payment terms. If you thought this thread of conversation was "taking attention away" why did you wallow into the mud with the rest of us?
It's neither imaginary nor black. They list their prices on their website: https://zerodium.com/program.html
Sure normally it is a joke but this one in particular does look like something that would actually be worth something to the right buyer