Yeah, like the weird idea that those programs are intended to in some way reduce the number of exploitable bugs actually out there.
I've written about this before here, but to sum it up:
* Unless something wild happens in software engineering (formal methods, &c) as a result of AI, there's no such thing as eradicating security vulnerabilities. Focused programs can eliminate low-hanging fruit, but at the point where you're offering significant bounties part of the premise is that all that fruit has been plucked. The marginal security impact of a single bounty award, by itself, is immaterial.
* What bounty programs can do is focus internal engineering attention. Large product teams have huge backlogs of issues and security design punch lists. For features and feature bugs, there's a closed loop that prioritizes the work: the market. For security vulnerabilities, bounties serve a similar purpose. This is why many bounties are tightly scoped; the whole point of the program is to direct the efforts of specific product teams.
* When we're talking about 10,000+ person engineering teams, the most important thing to know about bug bounty programs is that the company is incentivized to pay out. No major tech company that runs a bounty is "covering up" vulnerabilities. There's no reason for them to do so. They're running a program that ostentatiously pays rewards to people who report vulnerabilities! There are people on the teams managing the bounties who in effect get paid more when the program pays out more: that's what success looks like.
You add all this stuff up and all the drama about AMD (or Google or whoever) being shady or stingy basically never add up.
Nobody but AMD gives a fuck about AMD's internal policies or motivations.
If you don't care about AMD, why are you white-knighting AMD and defending AMD's bad behavior?
But, hey, OK, let's not make it about AMD specifically. It doesn't matter what any company thinks the purpose of its program is, nor does it matter what scope any company unilaterally decides to set for its program. What the outside world is going to see is whether or not you ignore security bugs. Your weird arcane internal policies, justifcations, and "scopes" are irrelevant. And, although I don't honestly care much about "security researchers", you can't really expect them to keep track of your private set of scope rules either... assuming you even tried to tell them the rules in advance to begin with.
My motivation here is very simple: I think people dunking on AMD's bounty program here mostly don't understand how bug bounties function. You apparently keep track of my comments on HN, so I think you know that's a beat I have here.