The payment was apparently USD 33'500.
Not being in the bug bounty business, I had expected a higher payment.
Not being in the bug bounty business, I had expected a higher payment.
It is like the anecdote of Tesla and Ford and knowing where to put the X[0], you aren't paying for time or manual labour - bug value is derived from how much damage it can cause, what its worth to Facebook to not be exploited and what the exploit is worth to the bad guys on the black market.
Time is often used to measure compensation – lawyers are well known for being paid in hourly fees –, however, in the long run, only results counts. And concerning the market, for how much could this bug have been sold, for example to the NSA?
I however believe he could easily have sold it on the black market for more. (Not saying that one should do such a thing.)